← News
/DISPATCH · 2026-08-09

CVE-2026-59726 RufRoot: Unauthorized RCE in Ruflo AI Agent Platform MCP Bridge (CVSS 10.0)

Ruflo's MCP bridge defaults to 0.0.0.0 with no authentication, allowing unauthenticated RCE, LLM API key theft, agent hijack, and persistent memory poisoning (CVE-2026-59726, CVSS 10.0). Upgrade self-hosted instances to 3.16.3 immediately.

The open-source AI agent orchestration platform Ruflo has an unauthenticated remote code execution vulnerability in its MCP (Model Context Protocol) bridge, CVE-2026-59726, dubbed RufRoot, CVSS 10.0. No credentials required: one POST request runs arbitrary commands in the container, steals LLM provider API keys, reads user conversations, hijacks running AI agents, and injects malicious instructions into persistent AI memory. All versions before Ruflo 3.16.3 are affected, covering self-hosted enterprise users among more than 67,000 GitHub stars.

Incident Overview

On 5 August 2026, Noma Labs disclosed that Ruflo's default docker-compose deployment binds the core MCP bridge to 0.0.0.0 with no authentication. The bridge is an Express.js server that handles all 233 AI agent tool calls, covering Shell, database, agent management, and persistent memory. Researchers disclosed to the Ruflo team; Ruflo shipped 3.16.3 within hours, security advisory GHSA-c4hm-4h84-2cf3, and a rollback-protection CI regression test.

Technical Details

Root cause is three stacked defects: first, `ruflo/docker-compose.yml` binds the MCP bridge to 0.0.0.0:3001 by default; second, POST `/mcp` skips authentication entirely and can invoke any tool; third, system-level tools such as `terminal_execute` are enabled by default and call the host Shell. Attackers need one curl:

curl -s -X POST https://<victim>:3001/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"ruflo__terminal_execute","arguments":{"command":"id && hostname"}}}'

After code execution, Noma Labs demonstrated a full 8-step attack chain on a default AWS EC2 deployment: enumerate 233 available tools → RCE → collect all LLM API keys (OpenAI, Anthropic, Google, OpenRouter) from process environment variables → spawn an attacker-controlled Agent Swarm on victim compute → inject a forged SOC2 compliance policy via `ruflo__agentdb_pattern-store` to poison future AI output → unload MongoDB and export all user conversations → write `/app/beacon.js` persistence → stay running via Docker `restart: unless-stopped` → wipe shell history.

Impact Assessment

Ruflo has large download and deploy volume; estimated active self-hosted users ~1 million. Any pre-3.16.3 instance with management ports reachable on the enterprise network can be compromised anonymously. CVSS v3.1 base score 10.0 (`AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`): low attack complexity, no privileges, no user interaction, and Scope change from in-container node user to MongoDB, LLM credentials, and downstream call chains. AI memory poisoning differs from classic persistence: poisoned memory can sit in trusted storage and keep shaping agent behavior after the initial intrusion.

Remediation

References