ruflo vulnerabilities

1 known vulnerability in ruflo from Ruvnet. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 10.0 Critical severity

  ruflo: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-59726Jul 9, 2026RuvnetEPSS 6.24%

  Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke