Executive Summary
Noma Security's RufRoot, CVE-2026-59726 (CVSS 10.0), in Ruflo, an agent meta-harness for Claude Code and Codex, allows unauthenticated command execution and AI memory poisoning before 3.16.3.
What Happened
Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex, that could result in unauthenticated remote code execution. The vulnerability, tracked as CVE-2026-59726 (CVSS score: 10.0), impacts all versions of the project before version 3.16.3. It has been codenamed RufRoot by Noma Security's
Affected Products
- Ruflo
- Claude Code
- OpenAI Codex
Vulnerability / Attack Technique
Unauthenticated RCE and memory poisoning in an agent harness
Technical Mechanism
As reported, an exposed MCP interface accepted commands without authentication.
AI Security Category
LLM03:2025 Supply Chain
Part of the MCP Security topic.
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Agent harnesses inherit full developer privileges. RealGround analysis: poisoned agent memory persists across sessions.
Recommended Controls
- Update Ruflo to 3.16.3
- Bind agent tooling to localhost only
- Reset agent memory if exposed
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/07/ruflo-mcp-flaw-lets-unauthenticated.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.