Ruflo MCP Bridge Unauthenticated Remote Code Execution (CVE-2026-59726)
Public exploit code is available for a critical unauthenticated remote code execution vulnerability (CVE-2026-59726) in the Ruflo MCP Bridge via the JSON-RPC interface.
CVE search metadata
CVE search record: CVE-2026-59726. Severity: critical. CVSS: 10.0. EPSS: 6.24%. KEV: no. Product: MCP Bridge. Brief: Ruflo MCP Bridge Unauthenticated Remote Code Execution (CVE-2026-59726). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ruflo-mcp-rce-cve-2026-59726/
Triage facts
Revision 1- Applicability
- MCP Bridge
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 13, 01:02 UTC
- Detection
- 1 rule
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
CVE-2026-59726 is an unauthenticated remote code execution vulnerability in the Ruflo MCP Bridge. The vulnerability allows an attacker to interact with the JSON-RPC endpoint at /mcp to invoke the 'ruflo__terminal_execute' tool, facilitating arbitrary command execution.
Attack Chain
An attacker can send an unauthenticated JSON-RPC request to the /mcp endpoint to trigger the 'ruflo__terminal_execute' tool, which provides the ability to execute commands on the host.
Impact
Successful exploitation permits arbitrary command execution on the target system.
Recommendation
Monitor for unauthorized access to the Ruflo MCP Bridge JSON-RPC interface.
Detection coverage 1
Detect Ruflo MCP Bridge Unauthenticated RCE Attempt
criticalDetects unauthenticated POST requests to the /mcp endpoint, which is the documented entry point for the CVE-2026-59726 vulnerability.
Detection queries are available on the platform. Get full rules →