Ruflo MCP Flaw Grants Unauthenticated RCE, Poisons AI Memory
A critical vulnerability (CVE-2026-59726) in the open-source Ruflo AI agent meta-harness allows unauthenticated attackers to achieve remote code execution and manipulate AI memory.
A severe security flaw, dubbed RufRoot and tracked as CVE-2026-59726 with a CVSS score of 10.0, has been discovered in Ruflo, an open-source agent meta-harness for AI models like Anthropic Claude Code and OpenAI Codex. This vulnerability affects all versions prior to 3.16.3 and enables unauthenticated attackers to gain remote code execution (RCE) capabilities.
Ruflo, originally known as Claude Flow, is a platform designed for deploying multi-agent AI systems, orchestrating autonomous workflows, and building conversational AI. The project has garnered significant attention, boasting over 66,500 stars on GitHub. The critical nature of this vulnerability stems from how Ruflo exposes numerous tools, including shell command execution, database operations, and memory management, through an unauthenticated Model Context Protocol (MCP) bridge. By default, this bridge is accessible over the network, making any network-reachable instance exploitable without any form of authentication.
The default docker-compose.yml configuration binds port 3001, which hosts the MCP bridge, to all network interfaces (0.0.0.0). This configuration, unless mitigated by specific firewall rules or network segmentation, leaves deployments vulnerable. An unauthenticated attacker can send a simple HTTP POST request to port 3001 to execute arbitrary commands within the compromised Ruflo deployment. For instance, a request targeting the ruflo__terminal_execute tool could allow an attacker to run commands like id && hostname.
Once an attacker gains a foothold through RCE, the potential for further compromise is extensive. They can steal API keys used by Ruflo to interact with LLM providers, access all stored user conversations, and critically, poison the AI's memory. This memory poisoning can influence future AI responses and behaviors, effectively manipulating the system long after the initial intrusion.
The NIST National Vulnerability Database (NVD) notes that prior to version 3.16.3, the exposed MCP bridge endpoints (POST /mcp and POST /mcp/:group) allowed attackers to invoke terminal_execute, gain a shell within the bridge container, steal provider API keys, and inject malicious patterns into the AgentDB learning store. This allows for persistent backdoors and manipulation of the AI's learning process.
Following responsible disclosure on June 30, 2026, the Ruflo maintainer, Reuven Cohen, released a patch within 24 hours. The update addresses the vulnerability by binding the MCP bridge to the loopback interface by default, restricting terminal_execute access through server-side controls, and enforcing MongoDB authentication to prevent unauthorized data access. The release notes highlight that the default docker-compose setup exposed both the bridge and MongoDB to all interfaces, enabling attackers to execute commands, steal API keys, and poison the AI's learning store.
Organizations running affected instances are strongly advised to immediately close firewall ports 3001 and 27017, rotate all LLM API keys, audit their AgentDB pattern store for malicious entries, and check MongoDB for any signs of tampering. Remediation extends beyond a simple software update; compromised credentials must be rotated, AI memory audited, and containers rebuilt from secure images to ensure a full recovery from potential compromise.
The newly disclosed article provides further technical details on the exploitation vectors, including how attackers can leverage the MCP Bridge to steal API keys for major LLM providers, hijack AI swarms, poison persistent memory stores, and directly access underlying MongoDB instances. It also elaborates on the specific security enhancements implemented in the patch, such as enforced token-based authentication, restricted localhost binding for the MCP Bridge, and the disabling of the terminal execution tool by default.