SECURITYJul 29 · 15:39 UTCTHE HACKER NEWS[email protected] (The Hacker News)

Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory

Cybersecurity researchers identified a critical security flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex, allowing unauthenticated remote code execution. The vulnerability, CVE-2026-59726 (CVSS score: 10.0), affects versions before 3.16.3 and was codenamed RufRoot by Noma Security.

Nexus surfaces and summarizes. The full story lives at the source.

Mentioned

RuflotopicNoma SecurityorganizationCVE-2026-59726topicRufRoottopicAnthropic Claude CodetopicOpenAI Codextopic

Spot something wrong with this article?Report a problem →

Forward this

Related Signal

Adjacent reporting

SECURITYApr 20 · 10:42 UTC
Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain
SECURITYApr 28 · 11:18 UTC
Critical Unpatched Flaw Leaves Hugging Face LeRobot Open to Unauthenticated RCE
SECURITYApr 28 · 16:15 UTC
GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
SECURITYJun 3 · 13:47 UTC
Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479)
SECURITYMay 7 · 20:03 UTC
Anthropic response to 1-click pwn: Shouldn't have clicked 'ok'