What is the CVSS score of CVE-2026-59726?

CVE-2026-59726 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Ruflo are affected by CVE-2026-59726?

Ruflo, the agent meta-harness infrastructure for Claude Code deployments, contains an unauthenticated remote code execution vulnerability in versions before 3.16.3 that allows network attackers to…. A patch is available.

Is there a public PoC exploit available for CVE-2026-59726?

Yes, a public proof-of-concept exploit is available for CVE-2026-59726. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-59726?

Within 24 hours: Immediately network-isolate the /mcp and /mcp/:group endpoints or place behind reverse proxy with authentication; review container access logs for suspicious POST requests to these endpoints. Within 7 days: Disable MCP bridge entirely if operationally feasible; rotate all provider API keys and secrets with access to bridge infrastructure; implement WAF or network firewall rules blocking unauthenticated access to bridge endpoints. Within 30 days: Monitor vendor advisories for Ruflo 3.16.3+ availability; plan immediate deployment of patched version once released; conduct forensic audit of AgentDB learning-store patterns for unauthorized modifications.

Ruflo CVE-2026-59726

EUVD-2026-42656 CRITICAL

OS Command Injection (CWE-78)

2026-07-09 security-advisories@github.com

Docker Command Injection

10.0

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Default docker-compose exposes an unauthenticated shell endpoint (AV:N/AC:L/PR:N/UI:N); container escape to provider keys and AgentDB justifies S:C with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 09, 2026 - 19:01 EUVD

Analysis Generated

Jul 09, 2026 - 18:40 vuln.today

CVE Published

Jul 09, 2026 - 18:16 cve.org

CRITICAL 10.0

DescriptionCVE.org

Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns. This issue is fixed in version 3.16.3.

Articles & Coverage 1

News Critical RCE in Docker via Ruflo MCP Bridge - CVE-2026-59726 Jul 10, 2026

AnalysisAI

Unauthenticated remote code execution in Ruflo (an agent meta-harness for Claude Code and Codex) before 3.16.3 arises because the default docker-compose deployment exposes the MCP bridge's POST /mcp and POST /mcp/:group endpoints with no authentication. A network attacker can send a JSON-RPC tools/call to the terminal_execute tool to gain an interactive shell inside the bridge container, exfiltrate provider API keys, and tamper with AgentDB learning-store patterns. Rated CVSS 10.0 with a scope change; no public exploit identified at time of analysis, and it is not in CISA KEV.

Technical ContextAI

Ruflo brokers tool calls between AI coding agents (Claude Code, Codex) and a set of MCP (Model Context Protocol) servers via an HTTP 'bridge' container. The bridge accepts JSON-RPC POST requests at /mcp and /mcp/:group, and one of the exposed tools, terminal_execute, is designed to run shell commands on the harness's behalf. Because the shipped docker-compose file published these routes to the network without any auth layer (token, mTLS, or network isolation), the tool-invocation surface was reachable by anyone who could reach the port. The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command / OS Command Injection): the terminal_execute primitive passes attacker-controlled input to a shell, and the missing authentication turns an intended internal capability into a public command-execution endpoint.

RemediationAI

Vendor-released patch: 3.16.3 - upgrade Ruflo to v3.16.3 or later, which is the authoritative fix per the GitHub advisory GHSA-c4hm-4h84-2cf3 (see https://github.com/ruvnet/ruflo/releases/tag/v3.16.3 and PR https://github.com/ruvnet/ruflo/pull/2521). If you cannot upgrade immediately, do not publish the MCP bridge port to any network interface: edit the docker-compose port mapping to bind only to 127.0.0.1 (e.g. '127.0.0.1:PORT:PORT') or drop the host port publish entirely and reach the bridge over the internal Docker network, and place a firewall/security-group rule blocking external access to the bridge port - the trade-off is that any legitimate remote or cross-host agent access will also be cut and must be tunneled or proxied with authentication. Additionally, since terminal_execute can read provider API keys, rotate all provider API keys that were present in the bridge container and review AgentDB learning-store patterns for tampering, because a pre-upgrade exposure may have already leaked credentials or poisoned stored patterns.