# Ruflo's Open MCP Bridge Handed Attackers Full Remote Code Execution — No Credentials Required


## The Threat


An open-source AI orchestration platform with tens of thousands of users shipped a default configuration that exposed over two hundred powerful tools — including shell execution and database access — to any network-reachable attacker with no authentication whatsoever. That's the short version of CVE-2026-59726, dubbed RufRoot by the Noma Security team that discovered it, and it's about as bad as vulnerabilities get.


Ruflo, originally launched as Claude Flow, is a multi-agent harness built on top of Anthropic Claude Code and OpenAI Codex. It lets developers deploy autonomous agent swarms, coordinate complex AI workflows, and build conversational systems. With more than 66,500 stars on GitHub, it's one of the more widely-adopted platforms in the fast-moving AI agent tooling space — which makes this flaw land harder than a typical remote code execution in a niche library.


The root cause was straightforward and brutal: Ruflo's docker-compose.yml bound the Model Context Protocol (MCP) bridge to 0.0.0.0:3001 by default, exposing it on every network interface with zero authentication enforced. The bridge sat in front of 233 registered tools. One of those tools was terminal_execute. A single unauthenticated HTTP POST was all it took to get a shell inside the bridge container — and from there, full access to every LLM API key stored in the environment, every user conversation on the platform, and the AgentDB learning store that shapes how the AI agents behave going forward.


## Severity and Impact


| Field | Detail |

|---|---|

| CVE | CVE-2026-59726 |

| Codename | RufRoot |

| CVSS Score | 10.0 (Critical) |

| CVSS Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |

| Attack Complexity | Low |

| Authentication Required | None |

| CWE | CWE-306 (Missing Authentication for Critical Function) |

| Discovered By | Eli Ainhorn, Noma Labs (Noma Security) |

| Disclosed | June 30, 2026 |

| Patched | July 1, 2026 (within 24 hours) |


## Affected Products


  • Ruflo (all versions prior to 3.16.3)

    • - Includes all deployments using the default docker-compose.yml configuration

    - MongoDB exposed on port 27017 to all interfaces in the same default config

    - Scope of exposure varies by firewall rules and network segmentation, but any network-reachable instance is fully exploitable without authentication


    ## Mitigations


    Immediate actions for all operators:


  • Upgrade to Ruflo 3.16.3 — the patch rebinds the MCP bridge to the loopback interface (127.0.0.1) by default, gates terminal_execute behind server-side executeTool controls, and enables MongoDB authentication
  • Close ports 3001 and 27017 at the firewall immediately if you cannot update right now — do not rely on application-layer fixes alone
  • Rotate all LLM provider API keys — assume any key stored in the container environment is compromised if your instance was externally reachable
  • Audit the AgentDB pattern store for injected agentdb_pattern-store entries — poisoned patterns persist and can continue steering AI outputs even after the vulnerability is patched
  • Review MongoDB for unauthorized access — check for signs of conversation harvesting or unauthorized collections
  • Inspect the /app directory for any files written by a potential attacker — persistent backdoors are a documented post-exploitation step for this vulnerability

    • Longer-term hardening:


  • Never bind MCP bridges or internal AI orchestration interfaces to 0.0.0.0 in any environment without an authentication layer in front
  • Treat AI agent frameworks the same as you would any privileged internal service — network segmentation, least-privilege, and explicit access controls are not optional

    • ## References


  • [NIST NVD — CVE-2026-59726](https://nvd.nist.gov/vuln/detail/CVE-2026-59726)
  • [Noma Security / Noma Labs Research](https://www.nomasecurity.io/)
  • [Ruflo GitHub Repository](https://github.com/ruvnet/ruflo)
  • [Ruflo Release Notes — v3.16.3](https://github.com/ruvnet/ruflo/releases)

    • ---


    ## HackWire Analysis


    RufRoot is a preview of a threat class that's going to define the next several years of security incident response: unauthenticated access to AI agent infrastructure. The MCP protocol itself is fine — it's a clean, structured way for AI systems to invoke tools. The catastrophic mistake here was an "open by default" posture on a bridge that controlled a shell, a database, and the cognitive memory of an AI system simultaneously. That's not one asset exposed — it's the entire stack.


    What makes this particularly dangerous is the AI memory poisoning angle, and it's the part most coverage will gloss over. Rotating API keys and patching the RCE vector is the obvious response. But if an attacker reached your AgentDB before you noticed the exposure, they may have written persistent behavioral patterns that survive the patch. Your agents could be subtly steered toward attacker-favorable outputs — leaking data, misrouting requests, generating responses calibrated for a threat actor's benefit — long after you believe the incident is closed. Security teams remediating this vulnerability need to treat the AgentDB as potentially compromised evidence, not just a system to restart.


    The broader pattern: AI orchestration frameworks are being adopted at a pace that far outstrips security review. Ruflo's maintainer deserves credit for patching within 24 hours of disclosure — that's genuinely fast. But 66,500 GitHub stars means a lot of deployments existed before this patch, and most self-hosted Docker configurations don't auto-update. The real exposure window is whatever percentage of those deployments had port 3001 reachable and haven't patched yet. If you run any AI agent framework in a Docker environment, today is a good day to audit every port binding in your compose files.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)