Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory

Kurzinfo

Metadaten

  • Original (extern): Link oeffnen
  • Veroeffentlicht: 2026-07-29 15:39 UTC
  • Importiert: 2026-08-05 11:32 UTC
  • CVSS: 10.0
  • Quelle-ID: thn_global
  • uid_hash: 70f97a3eedd73bf3cee5a1a16e912980fba2b624f4c01020fbcb92b4eb639d2d
The Hacker News

Inhalt

Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex, that could result in unauthenticated remote code execution.

The vulnerability, tracked as CVE-2026-59726 (CVSS score: 10.0), impacts all versions of the project before version 3.16.3. It has been codenamed RufRoot by Noma Security's

Verknuepfte CVEs

CVE-ID Severity (Quelle) CVSS (Quelle) Severity (CVE.org) CVSS (CVE.org) EPSS EPSS-Pctl Veroeffentlicht (CVE.org)

CVE-2026-59726

CRITICAL

10

CRITICAL

10

2026-07-09

Quellen-Details

Bezeichnung Name Kategorie Tags Zielgruppe Sprache Feed-URL
The Hacker News

thn_global

 security_news - de https://feeds.feedburner.com/TheHackersNews
Zurueck zur Eintrags-Liste