Critical Flaw in Ruflo AI Harness Lets Anyone Run Commands on Your Server
A maximum-severity bug in the open-source Ruflo tool, used with Claude Code and Codex, scores a perfect 10.0 and needs no login to exploit.
Key points
- Researchers at Noma Security disclosed a maximum-severity flaw, CVE-2026-59726, in the open-source Ruflo project, affecting every version before 3.16.3.
- The bug carries a CVSS score of 10.0, the highest possible, and lets an unauthenticated attacker run commands on the host machine.
- Ruflo sits between developers and AI coding assistants like Anthropic's Claude Code and OpenAI's Codex, so a compromised install can poison the AI's memory.
- Noma Security has codenamed the vulnerability RufRoot.
- Users should upgrade to Ruflo 3.16.3 immediately and audit any AI agent memory or configuration files touched by earlier versions.
Another week, another 10.0. This one lands on Ruflo, an open-source tool that a lot of teams have quietly bolted into their AI coding pipelines over the last year.
The flaw is tracked as CVE-2026-59726 and, per the advisory, an attacker does not need to log in, does not need a token, does not need to phish anyone. They just need to reach the service over the network.
What is Ruflo, in plain English?
Ruflo is a middle layer that sits between a developer and an AI coding assistant. Think of it as a plug board: on one side you have the human writing code, and on the other side you have an AI model like Anthropic's Claude Code or OpenAI's Codex doing the actual work. Ruflo routes instructions between them and remembers context across sessions.
That middle position is exactly what makes this bug nasty. If you own the plug board, you own everything flowing through it.
The project calls itself an "agent meta-harness", which is a fancy way of saying it manages other AI agents. In practice, teams run it on an internal server so their developers can share a common AI setup.
How bad is CVE-2026-59726?
It is as bad as the scoring system goes. A 10.0 CVSS score, the highest rating on the industry's standard severity scale, means low complexity, no authentication, and full impact on confidentiality, integrity and availability. Noma Security, the firm that found it, has codenamed the issue RufRoot, and first reporting came via The Hacker News.
The failure mode here is remote code execution: a stranger on the network sending a crafted request and getting the server to run whatever they want. From there, they can read files, install backdoors, or, more interestingly for an AI tool, tamper with the memory Ruflo hands to Claude or Codex.
That last part is the quiet horror story. If an attacker rewrites the AI's persistent memory, every developer using that Ruflo instance starts getting subtly poisoned suggestions. Malicious code snippets. Bad dependency names. Backdoored config. And it looks like it came from the AI they trust.
| Item | Detail |
|---|---|
| CVE ID | CVE-2026-59726 |
| CVSS score | 10.0 (critical) |
| Fixed in | Ruflo 3.16.3 |
| Affected | All versions before 3.16.3 |
| Discoverer | Noma Security |
What should teams do right now?
Upgrade to 3.16.3. Do it today, not next sprint. If your Ruflo instance has been exposed to any untrusted network, and honestly even if it hasn't, assume the AI memory store and any cached credentials on that host are suspect.
One thing the post-mortem will say: nobody thought of the AI harness as production infrastructure. It got installed by a curious engineer, ended up load-bearing, and never made it onto the patch calendar. That is the pattern with almost every AI tooling breach I have covered this year.
Check what your developers actually pointed at their models. That shadow AI stack is your new attack surface.
Operational takeaway: treat every AI middleware box like a production API gateway, because that is what it is.
