A critical security vulnerability has been identified in Ruflo, an open-source agent meta-harness for AI models like Anthropic Claude Code and OpenAI Codex. This flaw, designated as CVE-2026-59726 with a CVSS score of 10.0, allows unauthenticated remote code execution on affected systems.
Ruflo, formerly known as Claude Flow, is a platform that facilitates the orchestration of multi-agent AI systems, enabling users to deploy coordinated workflows and build conversational AI applications. The project has garnered significant attention, with over 66,500 stars on GitHub.
The vulnerability arises from Ruflo’s exposure of 233 tools—including shell command execution, database operations, and agent management—through an unauthenticated Model Context Protocol (MCP) bridge. By default, this bridge is accessible over the network, as the ‘docker-compose.yml’ configuration file binds port 3001 to 0.0.0.0, making it reachable on all network interfaces. The actual exposure depends on specific deployment configurations, such as firewall settings and network segmentation. However, any instance accessible over the network is fully exploitable without authentication.
Exploitation of this flaw is straightforward. An attacker can send a crafted HTTP POST request to port 3001, invoking the ‘ruflo__terminal_execute’ tool to execute arbitrary commands on the host system. For example:
curl -s -X POST https://<target>:3001/mcp -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"ruflo__terminal_execute","arguments":{"command":"id && hostname"}}}'
Once access is gained, an attacker can extract API keys used by Ruflo to interact with large language model providers, read all user conversations stored on the platform, and manipulate the AI system’s memory to alter model responses and behavior. This could lead to unauthorized data access, AI model manipulation, and the deployment of persistent backdoors by writing malicious payloads to the ‘/app’ directory.
Upon responsible disclosure of the vulnerability on June 30, 2026, Ruflo’s maintainer, Reuven Cohen, promptly released a fix within 24 hours. The patch includes binding the MCP bridge to the loopback interface by default, implementing server-side controls for the ‘terminal_execute’ function, and enabling MongoDB authentication to prevent unauthorized access to stored conversations.
Users operating Ruflo instances are strongly advised to update to version 3.16.3 or later to mitigate this vulnerability. Additionally, reviewing deployment configurations to ensure that sensitive services are not exposed to untrusted networks is crucial.
This incident underscores the importance of secure default configurations and thorough authentication mechanisms in AI system deployments. As AI platforms become more integrated into critical applications, ensuring their security is paramount to prevent potential exploitation and data breaches.
