Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory

CVE-2026-59726 in Ruflo AI orchestration platform allows unauthenticated remote code execution via an exposed Model Context Protocol bridge. Attackers can steal API keys, access user conversations, and corrupt AI memory without any credentials. Any organization running Ruflo is immediately exploitable.

CRITICALAdvisoryJul 31, 2026

Action required

Immediately identify and inventory all Ruflo deployments. Patch to the latest patched version or take affected instances offline. Scan for suspicious API key access, unusual conversation retrieval, and command execution logs dating back 30 days minimum.

Affected products

RufloNoma SecurityAnthropic Claude CodeOpenAI Codex

CVE IDs

CVE-2026-59726

Linked articles

Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory

Source links

https://thehackernews.com/2026/07/ruflo-mcp-flaw-lets-unauthenticated.html