{"data":{"id":"ff8d909c-3208-4986-abb3-f79e7120c892","title":"Critical Ruflo flaw lets attackers hijack AI agents through exposed MCP bridge","summary":"A critical vulnerability (CVE-2026-59726, called RufRoot) in the open-source Ruflo AI agent platform allows unauthenticated attackers to take complete control of enterprise AI systems by exploiting an exposed MCP bridge (Model Context Protocol, a system that lets AI agents interact with external tools and data). The flaw affects Ruflo versions before 3.16.3 and has a maximum severity score of 10.0, enabling attackers to execute arbitrary code, steal API keys, hijack AI agents, and manipulate the platform's memory through a single HTTP request.","solution":"Upgrade to Ruflo version 3.16.3 or later, which addresses the vulnerability.","labels":["security"],"sourceUrl":"https://www.csoonline.com/article/4203408/critical-ruflo-flaw-lets-attackers-hijack-ai-agents-through-exposed-mcp-bridge.html","publishedAt":"2026-07-30T12:29:58.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["prompt_injection","supply_chain"],"issueType":"news","affectedPackages":null,"affectedVendors":["LangChain"],"affectedVendorsRaw":["Ruflo","Noma Security"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-07-30T12:29:58.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}