Ruflo

Ruflo’s default MCP bridge exposed powerful tools without authentication

CVE-2026-59726 affected network-reachable default deployments before 3.16.3, with exposure shaped by surrounding network controls.

Security brief · 1 source · 29 Oct 2026