Ruflo Patches CVSS 10.0 Vulnerability That Gave Attackers Unauthenticated Access to AI Agent Infrastructure Through MCP Bridge

Ruflo released version 3.16.3 on July 29 to patch CVE-2026-59726, a critical vulnerability in the open-source AI agent platform’s Model Context Protocol bridge that allowed unauthenticated attackers to execute arbitrary commands, steal LLM API keys, and hijack entire agent swarms through a single HTTP request.

The flaw, dubbed “RufRoot” by researchers at Noma Security, carries a maximum CVSS score of 10.0. Noma Labs disclosed the vulnerability responsibly to Ruflo, which released fixes within hours along with a public security advisory. The issue is resolved.

The architectural pattern behind the exploit matters for any team running agents in production.

How the Attack Worked

Ruflo’s built-in MCP Bridge is an Express.js server that handles every tool invocation made by AI agents. According to InfoWorld, the bridge exposed 233 tools covering shell access, database operations, agent management, and memory storage, all without authentication.

The bridge’s /mcp endpoint accepted tool invocations via the MCP JSON-RPC protocol and passed them directly to an execution function with no authentication layer, according to Noma Security’s technical writeup. A command blocklist existed for Ruflo’s autopilot flow, but the /mcp endpoint bypassed it entirely.

Among the 233 exposed tools was ruflo__terminal_execute, which ran arbitrary shell commands inside the container. One HTTP POST to port 3001 gave full command execution. No token, no API key, no header check, no IP allowlist.

Noma Labs researchers demonstrated the full attack chain against a default Ruflo deployment running on AWS EC2, according to InfoWorld. They enumerated available tools, stole LLM provider API keys from environment variables, deployed attacker-controlled agent swarms, retrieved user conversations from MongoDB, and established persistence.

Memory Poisoning as a Persistence Mechanism

The researchers also demonstrated what they described as AI memory poisoning: inserting malicious entries into Ruflo’s AgentDB pattern store so that future AI responses would incorporate attacker-controlled instructions.

“The memory poisoning problem isn’t product-specific, and that’s the part worth paying attention to,” Amit Jena, AI Development Manager at Kanerika, told InfoWorld. “Any platform that gives agents a persistent, writable memory store needs to treat that store as a security boundary: who can write to it, and can you tell system-generated memory from memory an attacker planted. Very few platforms are doing that today.”

Unlike traditional persistence techniques, poisoned AI memory can remain inside a trusted data store and continue influencing agent behavior after the original intrusion has ended, according to Jena.

The Fix and What Remains

The patched release changes the MCP Bridge to bind to the loopback interface by default and fail closed if administrators attempt to expose it publicly without configuring authentication, according to Noma Security.

Noma Security recommended that organizations running Ruflo immediately restrict firewall access to ports 3001 and 27017, rotate all LLM API keys, and audit AgentDB for malicious entries. A patched redeploy alone does not undo memory poisoning.

The MCP Attack Surface

The default docker-compose.yml in Ruflo bound port 3001 to 0.0.0.0, exposing the bridge on all network interfaces, according to Noma Security. Ruflo has approximately 67,000 GitHub stars and ranks #2 on MCPMarket, with roughly 10 million downloads and 1 million active users.

“MCP adoption has outpaced the security defaults built into a lot of orchestration tools,” Jena told InfoWorld. “These platforms shipped fast, prioritized ease of setup over authentication, and assumed the network boundary would protect them. That assumption breaks down once the tool sits on a server reachable from a corporate network.”

The vulnerability represents the first critical exploit targeting the MCP bridge layer specifically. Previous agent security incidents, including the OpenAI rogue agent breach disclosed in late July, focused on model-layer behavior. RufRoot moved the attack surface to the infrastructure layer: the protocol pipes that connect agents to enterprise systems.