"The MCP bridge shipping in ruflo/docker-compose.yml exposed POST /mcp with no authentication," Reuven Cohen said in the release notes.
CVE-2026-59726 (RufRoot): scope and mechanics
Security researchers have assigned a maximum-severity rating to a vulnerability in Ruflo — tracked as CVE-2026-59726, CVSS score 10.0 — that allows unauthenticated remote code execution. Noma Security's research team, Noma Labs, codenamed the defect "RufRoot." The flaw affects all Ruflo versions before 3.16.3. Ruflo, launched originally as Claude Flow, is an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex that lets users deploy multi-player swarms, coordinate autonomous workflows, and build conversational AI systems; the project has more than 66,500 stars on GitHub.
Default docker-compose.yml and network exposure
Noma Labs and the National Vulnerability Database (NVD) found that the project's default "docker-compose.yml" configuration bound the Model Context Protocol (MCP) bridge's port 3001 to 0.0.0.0, exposing it on all network interfaces by default. The MCP bridge exposed 233 tools — including terminal/shell command execution, database operations, agent management, and memory storage — through unauthenticated MCP endpoints. The extent of any real-world exposure depends on an individual deployment's firewall rules, security groups, and network segmentation, but any network-reachable instance was described as fully exploitable without authentication.
Exploitation chain: single POST to full compromise
Researchers demonstrated that a single unauthenticated HTTP POST to port 3001 could yield a shell inside a susceptible Ruflo deployment. Security researcher Eli Ainhorn provided an exploit example that invoked the bridge's tools/call → terminal_execute method with a curl request:
curl -s -X POST https://<target>:3001/mcp -H "Content-Type: application/json" -d '{{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{{"name":"ruflo__terminal_execute","arguments":{{"command":"id && hostname"}}}}}}'
With remote command execution, an attacker could read the LLM provider API keys used by Ruflo, harvest every user conversation stored on the platform, and modify the system's persistent AI memory to influence future model responses. NIST's NVD summary and Noma Labs' analysis describe a clear chain: command execution → provider API key theft → attacker-controlled swarms using stolen keys → persistent poisoning of the AgentDB learning store → long-term influence over AI outputs. Attackers could also write malicious payloads into the container's /app directory to create persistent backdoors.
Patch, disclosure timeline, and mitigations implemented
Following responsible disclosure on June 30, 2026, the project's maintainer, Reuven Cohen, pushed a fix within 24 hours. The patch changes the default behavior so the MCP bridge binds to the loopback interface rather than all interfaces, gates the "terminal_execute" tool behind server-side executeTool controls, and enables MongoDB authentication to limit unauthorized access to stored conversations. Cohen noted in the release notes that the docker-compose defaults had bound both the bridge and MongoDB to all interfaces.
What this means for operators, AI providers, and defenders
- Operators running exposed Ruflo instances: Immediately close firewall ports 3001 and 27017 if they are reachable, rotate all LLM API keys used by Ruflo, audit the AgentDB pattern store for injected agentdb_pattern-store entries, and check MongoDB for signs of tampering. Rebuild containers from a clean image if compromise is suspected.
- AI providers whose keys were stored in Ruflo deployments: Treat credentials as compromised and enforce rotation. An attacker able to read provider API keys could spawn attacker-controlled swarms on victims' accounts, per Noma Labs' analysis.
- Security teams and defenders: Remediation requires more than applying the software update. Noma Labs advised that AI memory should be audited for tampering and that platform credentials be considered compromised; containers and persistent stores must be validated or rebuilt to remove implanted patterns and backdoors.
Noma Labs summarized the broader technical risk concisely: "The ability to write malicious instructions into a platform's persistent AI memory means an attacker can influence the responses that AI gives to every future user of the platform, long after the original intrusion has ended." For Ruflo users, the immediate facts are stark: a default network bind exposed powerful tooling; a single unauthenticated POST could turn into full platform compromise; and a quick upstream patch must be paired with credential rotation, data audits, and container hygiene to restore trust.
Original reporting: https://thehackernews.com/2026/07/ruflo-mcp-flaw-lets-unauthenticated.html
