Ruflo MCP Vulnerability Enables Remote Command Execution and AI Memory Poisoning

Key Takeaways

• A critical unauthenticated remote‑code‑execution flaw (CVE‑2026-59726, CVSS 10.0) was discovered in Ruflo, an open‑source AI‑agent orchestration harness for Anthropic Claude Code and OpenAI Codex.
• The vulnerability affects all Ruflo releases prior to version 3.16.3 and stems from the default exposure of the Model Context Protocol (MCP) bridge on all network interfaces via an unsecured docker-compose.yml configuration.
• Exploitation requires only a single unauthenticated HTTP POST to port 3001, granting attackers full shell access inside the bridge container.
• With this foothold, adversaries can steal LLM API keys, exfiltrate stored conversations, poison the AI’s persistent memory, and deploy persistent backdoors.
• The maintainer issued a patch within 24 hours of responsible disclosure, switching the MCP bridge to loopback‑only binding, adding server‑side execution controls, and enabling MongoDB authentication.
• Operators must close exposed ports, rotate all LLM credentials, audit AgentDB and MongoDB for tampering, and rebuild containers from clean images to ensure complete remediation.

Overview of the Vulnerability
Cybersecurity researchers identified a maximum‑severity security flaw in Ruflo, tracked as CVE‑2026-59726 with a CVSS score of 10.0. The issue, nicknamed RufRoot by Noma Security’s Noma Labs, impacts every version of the project prior to the 3.16.3 release. The flaw allows an unauthenticated attacker on the network to achieve remote code execution (RCE) within any exposed Ruflo deployment, effectively granting full control over the AI‑orchestration platform.

What Ruflo Is and Why It Matters
Originally launched as Claude Flow, Ruflo is an open‑source AI multi‑agent orchestration platform and harness designed to work with Anthropic’s Claude Code and OpenAI’s Codex. It enables users to deploy multi‑player swarms, coordinate autonomous workflows, and construct conversational AI systems. The project’s popularity is evidenced by more than 66,500 stars on GitHub, making it a widely adopted tool for developers building LLM‑powered applications.

How the Exposure Occurs
The core of the vulnerability lies in the Model Context Protocol (MCP) bridge that Ruflo uses to expose functionality over the network. In the default docker-compose.yml file, port 3001 is bound to 0.0.0.0, meaning the MCP bridge listens on all network interfaces without any authentication mechanism. Consequently, the bridge’s endpoints—including /mcp and /mcp/:group—are reachable by anyone who can communicate with the host, subject only to firewall or firewall, security‑group, or network‑segmentation controls.

Demonstrating the Exploit
Security researcher Eli Ainhorn showed that a single unauthenticated HTTP POST to the MCP bridge can trigger arbitrary shell commands. The proof‑of‑concept curl command is:

bash
curl -s -X POST http://:3001/mcp \
-H "Content-Type: application/json" \
-d ‘{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"ruflo__terminal_execute","arguments":{"command":"id && hostname"}}}’

This request invokes the tools/call method with the ruflo__terminal_execute tool, executing the supplied command inside the bridge container and returning the output to the attacker. Because the bridge runs with the container’s privileges, the attacker gains a full shell within the Ruflo environment.

Potential Post‑Compromise Activities
Achieving RCE opens the door to a wide range of malicious activities. An attacker can:

1. Extract LLM provider API keys stored as environment variables or configuration files, enabling unauthorized usage of paid AI services.
2. Read all user conversations persisted in the platform’s AgentDB or MongoDB stores, leading to data‑privacy breaches.
3. Poison the AI’s memory by writing malicious patterns into the AgentDB learning store, thereby influencing future model outputs for every subsequent user.
4. Deploy persistent backdoors by writing malicious payloads to the /app directory or creating rogue agent swarms that operate under the victim’s credentials.
5. Spawn attacker‑controlled agent swarms that abuse the stolen API keys to perform arbitrary tasks, effectively turning the victim’s infrastructure into a foothold for further intrusion.

Details from NVD and Researcher Commentary
The National Vulnerability Database (NVD) entry for CVE‑2026-59726 notes that, prior to version 3.16.3, Ruflo’s default docker‑compose deployment exposed the MCP bridge’s POST /mcp and POST /mcp/:group endpoints without authentication. This allowed an unauthenticated network attacker to invoke tools/call → terminal_execute, obtain a shell inside the bridge container, read provider API keys from the container’s environment, and inject harmful patterns into the AgentDB learning store. Noma Security emphasized that the ability to write malicious instructions into a platform’s persistent AI memory means an attacker can steer the AI’s responses for all future users, long after the initial breach has been remedied.

Timeline of Disclosure and Patch
The vulnerability was responsibly disclosed to the Ruflo maintainer, Reuven Cohen, on June 30, 2026. Within 24 hours, Cohen released a fix as part of version 3.16.3. The patch introduced several key changes:

• The MCP bridge now binds exclusively to the loopback interface (127.0.0.1) by default, preventing external network access.
• The terminal_execute tool is gated behind server‑side executeTool controls that require authentication or explicit authorization.
• MongoDB authentication is enabled, thwarting attempts to read or modify stored conversation data without valid credentials.
• Additional hardening steps include tightening file permissions and removing unnecessary exposed ports from the default compose file.

Recommendations for Affected Operators
Organizations running potentially exposed Ruflo instances should take immediate and comprehensive remedial actions:

1. Network‑level controls – Close firewall ports 3001 (MCP bridge) and 27017 (MongoDB) unless explicitly required, and restrict access to trusted IP ranges.
2. Credential rotation – Treat all LLM API keys, provider tokens, and any secrets stored within the Ruflo environment as compromised; rotate them immediately and audit usage logs for anomalies.
3. Data integrity checks – Examine the AgentDB pattern store for unexpected or malicious agentdb_pattern-store entries and inspect MongoDB collections for signs of tampering or unauthorized writes.
4. Container hygiene – Stop the affected containers, pull a clean image of Ruflo ≥ 3.16.3, and redeploy using the updated docker-compose.yml that binds services to localhost only.
5. Monitoring and logging – Enable detailed audit logs for MCP bridge requests, container exec events, and database access to detect any future exploitation attempts.
6. Long‑term strategy – Treat AI provider credentials as highly sensitive secrets, store them in a dedicated secrets manager, and enforce least‑privilege principles for all service accounts interacting with Ruflo.

By following these steps, operators can not only neutralize the immediate threat posed by CVE‑2026-59726 but also reduce the likelihood of similar vulnerabilities being exploited in the future. The incident underscores the importance of securing default configurations, especially in AI‑centric platforms where the combination of code execution and access to model credentials can lead to far‑reaching consequences.