CVE-2026-59726: Ruflo's default MCP bridge took no credentials, so one HTTP request gave a shell, LLM API keys and writable AI memory.
This is a feed excerpt, not the full article. The original reporting belongs to orcarouter.ai.
Read at orcarouter.ai