A critical unauthenticated remote code execution (RCE) vulnerability has been disclosed in the open-source AI agent orchestration platform Ruflo, exposing thousands of deployments to full system compromise.
Tracked as CVE-2026-59726 and dubbed “RufRoot,” the flaw carries a maximum CVSS score of 10.0 and affects Ruflo’s MCP Bridge component, which fails to enforce authentication on sensitive tool-execution endpoints.
Security researchers at Noma Labs identified that Ruflo’s MCP Bridge, an Express.js server responsible for handling Model Context Protocol (MCP) tool invocations, exposes 233 internal tools over HTTP without authentication.
These tools include capabilities for shell execution, database access, agent orchestration, and persistent memory management, effectively making the MCP Bridge the platform’s central control plane.
Critical Ruflo MCP Bridge Flaw
Ruflo, widely adopted for building agentic AI workflows, has seen rapid enterprise uptake due to its ability to orchestrate multi-agent “swarms,” integrate long-term memory, and execute real-world actions via MCP tooling.
However, this deep level of system integration also introduces significant security risks when core interfaces are exposed without safeguards.
The vulnerability stems from the MCP Bridge binding to all network interfaces (0.0.0.0) by default, typically exposing port 3001 in self-hosted deployments.
In such configurations, a single unauthenticated HTTP POST request to the /mcp endpoint allows attackers to invoke arbitrary tools. Notably, the ruflo__terminal_execute function enables direct shell command execution within the container environment.
Eli Ainhorn demonstrated that a crafted JSON-RPC request could execute commands such as system enumeration (id, hostname) without requiring API keys, tokens, or IP restrictions.
Although Ruflo includes a command blocklist for its autopilot mode, this protection is bypassed entirely when interacting directly with the MCP endpoint.
Exploitation extends far beyond initial access. Noma Labs developed an end-to-end proof-of-concept chain illustrating full environment compromise.
Attackers can enumerate available tools, execute commands, extract sensitive environment variables (including LLM API keys), and weaponize agent infrastructure using stolen credentials.
The platform’s architecture allows adversaries to spawn malicious agent swarms, poison long-term memory stores, and manipulate future AI-generated outputs.
Further impact includes unauthorized access to MongoDB instances running without authentication on internal Docker networks, enabling attackers to exfiltrate conversation histories and metadata.
Persistence can be achieved by writing malicious scripts within writable container directories and leveraging Docker’s restart policies to maintain execution across reboots.
The vulnerability is particularly dangerous in “Shadow AI” scenarios, where developers deploy Ruflo instances without centralized security oversight.
A default Docker Compose setup can inadvertently expose critical services to the internet, making exploitation trivial in poorly segmented environments. Following responsible disclosure, the Ruflo maintainers released a comprehensive patch within hours.
Security improvements include enforcing loopback binding by default, introducing bearer token authentication, disabling terminal execution unless explicitly enabled, requiring MongoDB authentication, and implementing stricter container isolation and CORS policies.
Users are strongly advised to immediately restrict access to ports 3001 and 27017, rotate all exposed API keys, audit memory stores for poisoning, and redeploy patched versions.
Given the platform’s access to sensitive data and execution capabilities, any exposed instance should be treated as fully compromised.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
 vulnerability has been disclosed in the open-source AI agent orchestration platform Ruflo, exposing thousands of deployments to full system compromise.){kind=link}