{"id":"CVE-2026-59726","aliases":["EUVD-2026-42656","GHSA-c4hm-4h84-2cf3"],"status":"published","title":"Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment","description":"Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns. This issue is fixed in version 3.16.3.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.06244,"percentile":0.93649,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-306","CWE-78","CWE-942"],"published":"2026-07-09T17:31:20Z","modified":"2026-10-28T02:31:10Z","exploits":[{"source":"pocgithub","id":"HORKimhab/CVE-2026-59726","title":"HORKimhab/CVE-2026-59726","date":"2026-07-30","url":"https://github.com/HORKimhab/CVE-2026-59726"},{"source":"exploitdb","id":"EDB-52705","title":"Ruflo MCP Bridge  3.16.2 - Remote Code Execution","type":"remote","platform":"python","date":"2026-11-11","url":"https://www.exploit-db.com/exploits/52705"},{"source":"nuclei","id":"CVE-2026-59726","title":"ruflo MCP Bridge - Unauthenticated RCE via terminal_execute","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-59726.yaml"}],"products":[{"vendor":"ruvnet","product":"ruflo"}],"references":[{"url":"https://github.com/ruvnet/ruflo/security/advisories/GHSA-c4hm-4h84-2cf3","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/ruvnet/ruflo/pull/2521","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/ruvnet/ruflo/commit/d00a0a40cd8bdbca877ac7f675f416bdc69accd1","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/ruvnet/ruflo/releases/tag/v3.16.3","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59726.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59726","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-59726","title":"Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment","description":"Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns. This issue is fixed in version 3.16.3.","status":"published","published":"2026-07-09T17:31:20.627Z","modified":"2026-07-09T18:43:24.749Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78","CWE-306","CWE-942"],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-42656","description":"Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns. This issue is fixed in version 3.16.3.","status":"published","published":"2026-07-09T17:31:20Z","modified":"2026-07-09T18:43:24Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:20:03.742277Z"}],"nvd":[{"id":"CVE-2026-59726","description":"Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns. This issue is fixed in version 3.16.3.","status":"published","published":"2026-07-09T18:16:57.337Z","modified":"2026-10-25T17:10:00.197Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78","CWE-306","CWE-942"],"updated_at":"2026-11-02T14:12:28.4135Z"}],"osv":[{"id":"CVE-2026-59726","title":"Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment","description":"Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns. This issue is fixed in version 3.16.3.","status":"published","published":"2026-07-09T17:31:20.627Z","modified":"2026-10-28T02:31:10.190742246Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-306","CWE-78","CWE-942"],"updated_at":"2026-11-02T15:45:12.496548Z"}]}}