CVE-2026-59726 Details.
ruflo MCP Bridge - Unauthenticated RCE via terminal_execute
Atlas does not check this one. Needs requests that change data.
To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check.
About CVE-2026-59726. What It Means.
ruflo MCP bridge (< 3.16.3) in its default docker-compose deployment exposes POST /mcp with no authentication and binds to all interfaces (0.0.0.0:3001). The executeTool() function has no server-side deny list for dangerous tools, allowing an unauthenticated attacker to invoke tools/call with ruflo__terminal_execute, which runs execSync(command) on attacker-supplied input. This yields arbitrary command execution as the node user (uid 1000) inside the bridge container. The bl…
Affected Product. What Is Hit.
- Vendor
- ruvnet
- Product
- Ruvnet Ruflo
FAQ
Common Questions.
ruflo MCP Bridge - Unauthenticated RCE via terminal_execute. ruflo MCP bridge (< 3.16.3) in its default docker-compose deployment exposes POST /mcp with no authentication and binds to all interfaces (0.0.0.0:3001). The executeTool() function has no server-side deny list for dangerous tools, allowing an unauthenticated attacker to invoke tools/call with ruflo__terminal_execute, which runs execSync(command) on attacker-supplied input. This yields arbitrary command execution as the node user (uid 1000) inside the bridge container. The bl…
No. To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check. The facts about CVE-2026-59726 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
CVE-2026-59726 is not on the CISA Known Exploited Vulnerabilities list at the time of writing, but it is still worth fixing.
Update Ruvnet Ruflo to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-59726. Atlas does not run a check for it, so nothing here says whether a particular site is affected.