Picture a self-hosted AI platform that promises to coordinate your enterprise's agents — shell access, database operations, memory, and everything in between — all behind a single clean interface. Now imagine discovering that the door to that platform was not just unlocked, but bolted open to the entire network by default, requiring no password, no token, and no authentication of any kind. That is not a hypothetical. That is RufRoot, a maximum-severity flaw in the open-source agent orchestration platform Ruflo, discovered by Noma Labs and tracked as CVE-2026-59726.
This is not another theoretical model-security scare. The impact is concrete and verified: a single unauthenticated HTTP POST to port 3001 granted full remote code execution inside a Ruflo deployment, exposing 233 tools that could read provider API keys, steal every stored conversation, spawn rogue agent swarms, and poison the AI's own persistent memory — effects that a software patch alone cannot undo.
What Is Ruflo — and Why Its Attack Surface Matters
Ruflo is an open-source agent "meta-harness" that sits on top of AI coding agents such as Anthropic Claude Code and OpenAI Codex. It is designed to coordinate multiple agents, give them tools, and manage their persistent memory across workflows — the kind of tooling that is increasingly central to how organizations run agentic AI. With more than 67,000 GitHub stars, it has a broad enterprise and developer footprint, which is precisely why an unauthenticated remote code execution in its core was treated as an emergency.
At the heart of Ruflo is the Model Context Protocol (MCP) Bridge, an Express.js server that handles every tool invocation a model can make. The bridge is effectively the platform's central control plane — and it was exposed to the network with zero authentication by default.
The Flaw: An Open Control Plane on Every Interface
The vulnerability lives in Ruflo's default docker-compose deployment, which bound the MCP bridge and its MongoDB to all network interfaces (0.0.0.0). As a result, in any self-hosted instance that did not deliberately harden its configuration, the bridge's POST /mcp and POST /mcp/:group endpoints answered requests from the whole network.
Those endpoints expect JSON-RPC tool invocations and pass them directly to the platform's executeTool() function — with no authentication layer. Among the 233 exposed tools is ruflo__terminal_execute, which runs arbitrary shell commands inside the container. Researcher Eli Ainhorn of Noma Labs demonstrated the whole thing with one request:
curl -s -X POST https://<target>:3001/mcp \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
"params":{"name":"ruflo__terminal_execute",
"arguments":{"command":"id && hostname"}}}'No token. No API key. No header check. No IP allowlist. A single request returned a shell.
What an Attacker Can Do With That Foothold
Because the exposed bridge wraps the platform's most sensitive operations, exploitation cascades far beyond command execution:
- Remote code execution: arbitrary shell commands inside the bridge container.
- Provider API-key theft: read the keys Ruflo uses to talk to LLM providers, then run workloads on the victim's accounts.
- Conversation and data exfiltration: access every user conversation and stored workflow.
- Rogue agent swarms: spawn attacker-controlled agents that act on the victim's keys.
- AI memory poisoning: inject patterns into the AgentDB learning store, tampering with the model's future outputs for every user — long after the attacker has left.
- Persistence and stealth: deploy backdoors and clear shell history to remove traces.
The most disturbing piece is the memory poisoning. Ruflo's persistent memory is what agents "remember" across sessions, and it is treated as a trusted knowledge base. An attacker who poisons it does not just break the host; they commandeer the AI's understanding of the world around it, shaping its behavior for everyone — an effect that survives even after the code is patched.
Responsible Disclosure and the Fix
Noma Labs disclosed the vulnerability to the Ruflo maintainers on June 30, including a working proof-of-concept validated against a live default deployment. The fix landed in version 3.16.3, which switches the platform to a locked-down configuration by default — public exposure is now an explicit opt-in that requires authentication. The maintainers shipped the comprehensive patch quickly, and Noma Labs independently verified it. The flaw is tracked as CVE-2026-59726 with a CVSS score of 10.0, the maximum possible severity.
Remediation: What Teams Must Do Now
- Upgrade immediately to Ruflo 3.16.3 or later on all deployments.
- Verify network exposure: confirm the MCP bridge (port
3001) and MongoDB are not bound to0.0.0.0; restrict them behind authentication and allowlists. - Audit executed requests: review HTTP access logs for unknown calls to
/mcpand/mcp/:groupsince the deployment date. - Rotate provider keys: replace any LLM API keys, database credentials, and secrets the bridge could reach.
- Reset poisoned memory: because patching does not undo memory poisoning, rebuild or re-seed the AgentDB learning store and audit agent conversations for tampering.
- Isolate AI infrastructure: run agent platforms in segmented networks with strict egress controls, and never expose control-plane endpoints to untrusted networks.
The Bigger Lesson: The AI Control Plane Is the New Perimeter
RufRoot is a warning shot for the agentic AI era. The trend is to hand AI agents powerful tools — shell access, databases, memory — and to consolidate that control in orchestration platforms like Ruflo. But a tool that is powerful for an AI is equally powerful for an attacker, and if the control plane that wires those tools together ships without authentication, the AI does not need to be "hacked" at all. The attacker simply logs in through the open door the platform left behind.
Security teams must apply to agent infrastructure the same discipline they use for any server: default-deny networking, mandatory authentication on control planes, short-lived scoped credentials, and continuous auditing. The model may be the new intelligence layer, but the platform that brokers its power is the new perimeter — and it needs to be locked like one.
Technical sources: Noma Labs disclosure "RufRoot", The Hacker News, SecurityWeek, CSO Online, and the NVD entry for CVE-2026-59726.