RufRoot (CVE-2026-59726) is a CVSS 10.0 vulnerability in Ruflo (formerly Claude Flow), an open-source multi-agent orchestration layer, where the default Docker Compose config exposed the MCP bridge without authentication, allowing a single request to invoke terminal_execute and access all 233 tools, leaking LLM provider API keys and stored conversations. Attackers could also write to AgentDB, Ruflo's persistent agent memory, so poisoned instructions survive upgrades; the fix in version 3.16.3 requires credential rotation and an AgentDB audit, not just patching.

🌐 Visit website ↗

🔗 Similar tools