2026年7月29日 11:39 ET 发布 · 更新于 3 个月前 · 1 个来源
Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory
The Hacker News
·
原始报道
Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex, that could result in unauthenticated remote code execution. The vulnerability, tracked as CVE-2026-59726 (CVSS score: 10.0), impacts all versions of the project before version 3.16.3. It has been codenamed RufRoot by Noma Security's
原文