A critical vulnerability in Ruflo called CVE-2026-59726 (RufRoot) exposes 233 MCP tools without authentication, enabling remote code execution, LLM API key theft, and persistent memory poisoning. The flaw survives patching attempts, posing sustained security risks.
No BS check run yet — press ⚖ to extract this story's claims and verify them against independent sources.
CVE-2026-59726 in Ruflo exposes 233 MCP tools without authentication, enabling RCE, LLM API key theft, and persistent memory poisoning that https:// deafnews.it/en/article/rufroot -the-ai-vulnerability-that-survives-the-patch-233-tools-exposed-and-persistent-memory-poisoning
RufRoot: The AI Vulnerability That Survives the Patch — 233 Tools Exposed and Persistent Memory Poisoning CVE-2026-59726 in Ruflo exposes 233 MCP tools without authentication, enabling RCE, LLM API key theft, and persistent memory poisoning that survives the 3.16.3 update. NIST rates it CVSS 10.0.