Security brief

Ruflo’s default MCP bridge exposed powerful tools without authentication

REVIEW

CVE-2026-59726 affected network-reachable default deployments before 3.16.3, with exposure shaped by surrounding network controls.

Published 29 Oct 2026 · Material update 29 Jul 2026 — last time the underlying evidence changed · Evidence: medium

What happened

The Ruflo disclosure describes an unauthenticated MCP bridge in the project’s default Docker Compose deployment. A reachable attacker could invoke powerful tools, including shell execution, and access secrets inside the bridge environment.

The issue is in Ruflo, an orchestration layer, rather than proof of a vulnerability in every Claude Code or Codex installation it can manage. Binding to all interfaces increases reachability, while firewall and network controls still determine actual exposure.

The reported fix is 3.16.3. Update to a maintained release, restrict bridge access and investigate reachable older deployments for unauthorized tool calls, credential access and changes to agent memory.

Read the original source.

Next step

Update Ruflo, restrict bridge access and investigate previously exposed instances.

What remains unknown

Open question
The sources reviewed do not establish whether your deployment was exploited.

Source references

Technical details

CVE
CVE-2026-59726