CVE-2026-59726

Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment

No known exploitation. EPSS puts it in the 87th percentile. No fix published yet.

CVSS 3.110.0Critical EPSS percentile87th3.0% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-07-09Updated 2026-07-10Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Check it yourselfA free Nuclei check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns. This issue is fixed in version 3.16.3.

In plain language

Written by AI from the record

If you run Ruflo with the default Docker Compose setup before 3.16.3, attackers on the network can reach an open endpoint and run commands on your server container, steal stored API keys, and disrupt your Ruflo data—this is serious and you should act now.

In Ruflo versions prior to 3.16.3, the default Docker Compose deployment exposes the MCP bridge endpoints without authentication, enabling an unauthenticated remote attacker to trigger remote command execution in the bridge container, access stored API keys, and manipulate the internal AgentDB learning-store.

If you're affected

Full server/container compromise
API key theft
Learning-store poisoning
Service disruption

What is it

Ruflo is a tool that helps connect an AI agent to other systems. In versions before 3.16.3, the default Ruflo setup opens a network “door” without a lock for the MCP bridge. Think of it like leaving a backend keypad accessible from the street—an attacker can use it to run commands inside your container, grab stored secrets, and corrupt Ruflo’s internal data.

Who is affected

This matters if you run the Ruflo application and you use the default Docker Compose deployment that exposes the MCP bridge endpoints to the network. It only becomes a risk if the exposed bridge endpoints are reachable from the internet or any untrusted network. There is no authentication required and no user interaction needed for an attacker to attempt the attack.

How urgent is it

Treat this as urgent: the issue is reachable by network attackers and has no authentication requirement, which means it can be directly targeted. The fix is available (upgrading to 3.16.3 stops this exposure), and the likelihood of opportunistic scanning/attacks is rising. Because there is no KEV listing and no clear dated incident report, focus on preventing compromise first by upgrading and limiting external reachability.

What to do — in detail

Confirm exposure in your environment
- Determine your Ruflo version (must be prior to 3.16.3 to be affected).
- Confirm you are using the default Docker Compose deployment and that the MCP bridge endpoints are exposed without authentication (as described for the default setup).
- Verify whether the MCP bridge endpoints are reachable from outside your network (internet or any untrusted network). If they are not reachable externally, risk is reduced.
Upgrade to the fixed version
- Upgrade Ruflo to 3.16.3 (or later). This is the identified fix.
- After upgrading, ensure the new deployment no longer exposes the unauthenticated MCP bridge endpoints in the same way.
If you must delay upgrading (temporary containment while you schedule the upgrade)
- Block inbound access to the MCP bridge endpoints from the internet/untrusted networks (firewall, security group, reverse proxy rules, or Docker network exposure restrictions).
- Ensure only trusted internal networks can reach the Ruflo MCP bridge.
- Monitor access attempts to those endpoints and related container processes for signs of misuse.
Post-upgrade checks
- Re-check external reachability of the MCP bridge endpoints.
- Rotate any provider API keys used by Ruflo, because the vulnerability’s impact includes key exposure.
- Review Ruflo’s internal learning-store behavior for unusual patterns indicating poisoning (if your workflow has seen unexpected behavior).

CISA KEV due date: not listed in CISA KEV (no KEV due date provided in the findings).

Technical context

Severity and issue type: This is an unauthenticated remote code execution risk with additional impact to confidentiality (stored API keys) and integrity (manipulation/poisoning of AgentDB learning-store).

Mechanism (how it’s triggered): In Ruflo versions prior to 3.16.3, the default Docker Compose deployment exposes the MCP bridge endpoints (POST /mcp and POST /mcp/:group) without authentication. A remote attacker who can reach these endpoints over the network can invoke the MCP tool/call path that leads to terminal execution, resulting in code execution inside the bridge container.

Exploitation status: KEV is not listed, and no clear dated press exploitation claim or incidents were provided in the findings. However, the vulnerability is stated as reachable in the default configuration and has rising predicted likelihood.

Patch status: A fix is indicated as “fixed in version 3.16.3.” No additional patch details were available beyond that version.

Attacker prerequisites: Network access to the exposed MCP bridge endpoints; no authentication and no user interaction are required.

CWE mapping from the findings: CWE-78 (improper neutralization of special elements used in an OS command), CWE-306 (missing authentication), and CWE-942 (command execution / resource behavior that can be abused).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS87th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

3.0% chance of exploitation activity in the next 30 days, which ranks it in the 87th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

unknown.

Real risk signals with little public attention so far.

Lifecycle

12 events over 77 days, from the signal feeds we watch.

2026-09-24EPSS band changemoderate → lowepss band change
2026-09-19EPSS band changelow → moderate
2026-09-18EPSS band changelow → moderate
2026-09-16EPSS band changelow → moderateepss band change
2026-09-15Nuclei check added
2026-07-10Record updated

Affected products

ruvnetoss-project
- rufloLibraryOSS Libraries / generic-library

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable