A critical maximum-severity vulnerability (CVE-2026-59726, CVSS 10.0) has been discovered in Ruflo, an open-source meta-harness for AI coding agents including Anthropic Claude Code and OpenAI Codex. The flaw, dubbed 'RufRoot,' enables unauthenticated attackers to execute remote code and potentially poison AI memory, affecting all versions prior to 3.16.3.
Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex, that could result in unauthenticated remote code execution. The vulnerability, tracked as CVE-2026-59726 (CVSS score: 10.0), impacts all versions of the project before version 3.16.3. It has been codenamed RufRoot by Noma Security's
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
