RufRoot: CVSS 10 in Ruflo MCP Bridge Enables Unauthenticated RCE

A CVSS 10.0 vulnerability in Ruflo, the open-source AI agent meta-harness widely used with Claude Code and OpenAI Codex, gave unauthenticated network attackers a single HTTP request path to shell execution, LLM API key theft, and persistent manipulation of the platform’s AI memory store. Noma Labs disclosed CVE-2026-59726 on June 30, 2026. The maintainer patched within 24 hours. The patch closes the entry point. It does not undo poisoned memory.

What Ruflo Is and Why This Matters

Ruflo is an agent orchestration harness designed to coordinate AI coding assistants, manage their tool access, and accumulate learned patterns across sessions. It connects Claude Code, OpenAI Codex, and other agents to tool sets via the Model Context Protocol (MCP), then stores successful agent actions in AgentDB, a MongoDB-backed learning store that shapes how agents respond to future tasks.

The platform’s Docker deployment is designed for local or team use. Its default docker-compose configuration made an architectural decision with serious consequences: it bound the MCP bridge to 0.0.0.0.

The Vulnerability

Ruflo’s MCP bridge is an Express.js server that handles all tool invocations for agents running in the platform. It exposes 233 internal tools over HTTP. Before version 3.16.3, that server had no authentication. No Bearer token. No API key header check. No IP allowlist. No rate limiting. The docker-compose default bound it to every network interface on port 3001, meaning any host with network access to the Ruflo machine could reach it.

The exploit requires one request:

POST http://<target>:3001/mcp
Content-Type: application/json

{
  "tool": "ruflo__terminal_execute",
  "arguments": {
    "command": "id && env"
  }
}

That returns a shell response as the node process user inside the container, along with all environment variables including LLM provider API keys. No authentication step. No token. Nothing.

From that shell, the attack chain branches in multiple directions simultaneously.

The Four Exploitation Paths

Shell and API key theft. The ruflo__terminal_execute tool runs arbitrary commands in the container environment. Standard deployment practice places ANTHROPIC_API_KEY, OPENAI_API_KEY, and similar credentials in the container’s environment. A single env call returns them.

AI memory poisoning. The ruflo__agentdb_pattern-store tool writes directly to AgentDB, the persistent store that Ruflo’s agents query when deciding how to respond to tasks. An attacker can inject behavioral patterns that redirect agent actions, cause agents to exfiltrate data to external endpoints, or introduce subtle logic errors into code the agents produce. This affects all users of the compromised Ruflo instance.

Swarm spawning. Tools ruflo__swarm_init and ruflo__agent_spawn allow the attacker to launch new agent processes using the victim’s API keys. The attackers spend the victim’s compute budget on attacker-defined work.

Conversation access. MongoDB on port 27017 was also exposed without authentication in default deployments. An attacker could query the full conversation history for all agents that ran through the instance.

Why Patching Is Not Sufficient Alone

Ruflo 3.16.3 addresses the access control failures. The MCP bridge now binds to the loopback interface by default, requires Bearer authentication with constant-time comparison, gates terminal_execute behind the MCP_ENABLE_TERMINAL=true environment variable (disabled by default), and enables MongoDB authentication.

The problem is what persists after the patch.

AgentDB is a behavioral learning store. Patterns written to it shape how agents respond to future tasks. An attacker who exploited CVE-2026-59726 before the patch and wrote instructions into AgentDB did not need to maintain access. Their instructions remain in the store and continue influencing agent behaviour for every task that matches the injected patterns, against every user of that instance, indefinitely.

Updating to 3.16.3 prevents new exploitation. It does not purge existing AgentDB content. Organizations that ran vulnerable versions need to treat their AgentDB as potentially compromised and audit it, regardless of whether they have logs showing exploitation.

Dark Reading noted this as the “patch-resistant” characteristic of the vulnerability: the initial access point is closed by the patch, but the persistence mechanism lives in a data store that software updates do not reset.

Exposure Assessment

Ruflo is positioned as a local or small-team deployment tool. Shodan scans have shown small numbers of internet-facing instances. The larger risk is within organizational networks, where a Ruflo deployment on a developer workstation or internal server might be reachable by other machines on the same network segment without the developer expecting that exposure.

Any environment where the Ruflo container runs alongside other services on a shared network, and where the MCP bridge port was not explicitly firewalled, should be treated as at risk.

Defensive Actions

Immediate, regardless of version:

• Firewall port 3001 and 27017 at the host or network level. Neither should be accessible beyond localhost.
• Rotate all LLM API keys that were present in the container environment.
• Audit MongoDB conversation logs for access from unexpected source IPs.

If running any version before 3.16.3:

• Update immediately. The patch applies straightforward access controls that eliminate the primary attack surface.
• Audit AgentDB for injected patterns. Compare current pattern store content against known-good backups or authorised user history. Patterns that cannot be attributed to legitimate use should be removed.
• Consider resetting AgentDB entirely if a clean audit cannot be established.

Going forward:

• Never bind the MCP bridge to 0.0.0.0. The loopback default in 3.16.3 is correct; override it deliberately only when the access control implications are understood.
• Treat MCP tool endpoints as high-privilege interfaces. Any tool that can execute shell commands or write to persistent agent memory is a privileged endpoint that requires authentication commensurate with that access.

The broader pattern here is consistent with what we have seen across AI orchestration platforms: MCP bridges and agent tool endpoints are high-value attack surfaces that default deployments frequently leave exposed. RufRoot is the most severe instance to date of the same misconfiguration class that affected LiteLLM, PraisonAI, and Semantic Kernel.

References

• Noma Security — RufRoot: The MCP Bridge Vulnerability That Turns Agents Into Rogue Admins
• The Hacker News — Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory
• SecurityWeek — Critical Ruflo Flaw Lets Attackers Spawn Rogue AI Swarms
• Dark Reading — Patch-Resistant Rufroot Flaw Can Unleash Malicious AI Agent Swarms
• OpenCVE — CVE-2026-59726