Critical vulnerability in Ruflo AI agent platform allows unauthenticated attacker control

According to CSO Online, Noma Security researchers disclosed CVE-2026-59726, a critical flaw in the open-source Ruflo AI agent platform that exposes an unprotected Model Context Protocol (MCP) bridge. The vulnerability permits unauthenticated attackers to take full control of enterprise environments running the platform. The disclosure comes as enterprise AI agent deployments expand into financial and operational workflows across regulated sectors.