Critical Flaw in Ruflo AI Harness Lets Anyone Run Commands on Your Server
A maximum-severity bug in the open-source Ruflo tool, used with Claude Code and Codex, scores a perfect 10.0 and requires no login to exploit.
Key points
- Researchers at Noma Security disclosed a maximum-severity flaw, CVE-2026-59726, in the open-source Ruflo project, affecting every version before 3.16.3.
- The bug carries a CVSS score of 10.0, the highest possible rating, and lets an unauthenticated attacker run arbitrary commands on the host machine.
- Ruflo sits between developers and AI coding assistants like Anthropic's Claude Code and OpenAI's Codex, so a compromised install can poison the AI's memory.
- Users should upgrade to Ruflo 3.16.3 immediately and audit any AI agent memory or configuration files touched by earlier versions.
Another week, another 10.0. This one lands on Ruflo, an open-source tool that a lot of teams have quietly bolted into their AI coding pipelines over the last year.
The flaw is tracked as CVE-2026-59726 and, per the advisory, an attacker does not need to log in, does not need a token, does not need to phish anyone. They just need to reach the service over the network.
What is Ruflo, in plain English?
Ruflo is a middle layer that sits between a developer and an AI coding assistant. On one side you have the human writing code; on the other you have a model like Anthropic's Claude Code or OpenAI's Codex doing the actual work. Ruflo routes instructions between them and remembers context across sessions.
That middle position is exactly what makes this bug nasty. Own the routing layer, own everything flowing through it.
The project describes itself as an "agent meta-framework", meaning it manages other AI agents. Teams typically run it on an internal server so developers can share a common AI setup.
How bad is CVE-2026-59726?
It is as bad as the scoring system goes. A CVSS score of 10.0 means low complexity, no authentication required, and full impact on confidentiality, integrity and availability. Noma Security, the firm that found it, has codenamed the issue RufRoot, and first reporting came via The Hacker News.
The failure mode is remote code execution: a stranger on the network sends a crafted request and gets the server to run whatever they want. From there, they can read files, install backdoors, or tamper with the memory Ruflo hands to Claude Code or Codex.
That last part is the quiet horror story. If an attacker rewrites the AI's persistent memory, every developer on that Ruflo instance starts receiving subtly poisoned suggestions: malicious code snippets, bad dependency names, backdoored config. It looks like it came from the AI they trust. Our 9 July story showed Claude Code and Codex executing attacker-supplied code in autonomous mode; a compromised Ruflo memory store is a quieter path to the same outcome.
| Item | Detail |
|---|---|
| CVE ID | CVE-2026-59726 |
| CVSS score | 10.0 (critical) |
| Fixed in | Ruflo 3.16.3 |
| Affected | All versions before 3.16.3 |
| Discoverer | Noma Security |
What should teams do right now?
Upgrade to 3.16.3. Today, not next sprint. If your Ruflo instance has been exposed to any untrusted network, assume the AI memory store and any cached credentials on that host are suspect.
The post-mortem template writes itself: nobody classified the AI middleware box as production infrastructure. A curious engineer installed it, it became load-bearing, it never made it onto the patch calendar. I've filed that story more times this year than I'd like.
Check what your developers actually pointed at their models. That shadow AI stack is your real attack surface.
Treat every AI middleware box like a production API gateway, because that is exactly what it is.
