Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory
Researchers at Noma Labs found a CVSS 10.0 flaw, CVE-2026-59726, in Ruflo, an open-source agent meta-harness for Claude Code and Codex with more than 66,500 GitHub stars, affecting all versions before 3.16.3. The default docker-compose file bound port 3001...