A critical vulnerability in the open-source AI orchestration platform Ruflo has been disclosed, allowing unauthenticated attackers to achieve full remote code execution (RCE) with a single HTTP request.
This vulnerability, tracked as CVE-2026-59726 and referred to as “RufRoot,” has been assigned a maximum CVSS score of 10.0 due to its ease of exploitation and potential for complete system compromise.
Critical Ruflo MCP Bridge Flaw
Discovered by Noma Labs, the flaw lies in Ruflo’s Model Context Protocol (MCP) Bridge, an Express.js server that manages tool invocations across agent workflows.
The MCP Bridge exposes 233 high-privilege tools via HTTP without authentication, providing a direct path for attackers to access system-level functionality.
Ruflo is widely adopted as a meta-harness for deploying AI agent swarms, with tens of thousands of GitHub stars and millions of downloads.
The platform allows organizations to orchestrate intelligent agents, maintain persistent memory, and execute real-world actions through integrated tooling. However, this deep integration with system resources raises a critical security concern focused on the MCP Bridge.
By default, Ruflo deployments bind to port 3001 on all network interfaces (0.0.0.0), making the MCP endpoint publicly accessible in many self-hosted environments.
The /mcp endpoint accepts JSON-RPC requests and directly forwards tool execution calls without enforcement of authentication, API keys, or access controls. This design flaw permits any network-accessible attacker to invoke sensitive operations.
One of the exposed tools, ruflo__terminal_execute, allows arbitrary shell command execution within the container. A single crafted HTTP POST request can execute commands, including system identity checks, effectively providing attackers with immediate shell access.
Although execution occurs under a non-root user, the container environment grants access to sensitive credentials, APIs, and internal services, making privilege escalation unnecessary in most cases.
Once access is established, attackers can move laterally across the platform and compromise its entire ecosystem. Since Ruflo serves as the central orchestration layer for agents, memory, and integrations, exploiting the MCP Bridge effectively grants control over all core functionalities.
Full Attack Chain and Impact:
- Tool enumeration using tools/list to identify all 233 exposed functions without authentication.
- Remote code execution via ruflo__terminal_execute, validated through external callbacks.
- Extraction of environment variables using commands like printenv, exposing API keys for LLM providers.
- Abuse of stolen credentials to deploy attacker-controlled agent swarms.
- Poisoning of persistent memory stores to manipulate future AI outputs and workflows.
- Unauthorized access to MongoDB instances running without authentication, enabling data exfiltration.
- Establishment of persistence by writing backdoor scripts into writable directories and modifying runtime execution.
- Cleanup of artifacts to evade detection and forensic analysis.
The vulnerability also highlights the growing risk of Shadow AI, where powerful AI systems are deployed without adequate security oversight.
Ruflo’s ease of deployment, often requiring just a simple Docker command, increases the likelihood that insecure configurations will be exposed to the internet.
Following responsible disclosure, the Ruflo development team responded promptly by releasing a comprehensive patch that addresses all identified attack vectors.
The security improvements include binding the MCP Bridge to localhost by default, enforcing authentication through bearer tokens, disabling terminal execution unless explicitly enabled, ensuring MongoDB authentication, and implementing stricter container and CORS security controls.
Organizations using Ruflo are strongly advised to restrict access to ports 3001 and 27017 immediately, rotate all associated API keys, audit agent memory stores for signs of poisoning, and redeploy patched versions. Security teams should also review logs and monitor for unusual agent behavior or unauthorized tool execution.
This incident underscores the importance of secure-by-default configurations in AI infrastructure, especially as agent-based platforms become increasingly integrated into enterprise environments.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
