A maximum-severity vulnerability in Ruflo, an open-source AI agent orchestration platform with more than 67,000 GitHub stars, allowed unauthenticated attackers to gain full remote code execution — and then poison the platform’s persistent AI memory in a way that a software patch alone cannot undo.
The flaw, tracked as CVE-2026-59726 (CVSS 10.0) and codenamed RufRoot by Noma Security’s research team Noma Labs, exposed Ruflo’s Model Context Protocol (MCP) bridge to the network without any authentication. That bridge handles every tool invocation in the platform — 233 tools covering shell access, database operations, agent management, and memory storage.
One Request, Full Compromise
A single unauthenticated HTTP POST to port 3001 was enough to execute arbitrary shell commands inside the container, according to Noma Labs researcher Eli Ainhorn.
“A single unauthenticated HTTP POST request to port 3001 gave full command execution inside the container. No token, no API key, no header check, no IP allowlist. Nothing,” Ainhorn wrote in the Noma Security blog post disclosing the finding.
The attack chain is short. The MCP bridge’s POST /mcp endpoint accepts JSON-RPC tool invocations and passes them directly to executeTool() with no authentication layer. Among the 233 exposed tools is ruflo__terminal_execute, which runs arbitrary shell commands inside the container. A command blocklist exists but applies only within the autopilot flow — the /mcp endpoint bypasses it entirely.
From that foothold, Noma Labs demonstrated an automated eight-step proof of concept against a default Ruflo deployment on AWS EC2: reconnaissance via tools/list, remote code execution via terminal_execute, theft of all LLM provider API keys (OpenAI, Anthropic, Google, OpenRouter) from container environment variables, weaponization of the victim’s own API keys to spawn attacker-controlled agent swarms, AI memory poisoning, MongoDB conversation theft, persistent backdoor deployment, and forensic cleanup.
The Memory Poisoning Vector
The most novel piece of the attack is the AI memory poisoning step. Ruflo includes an AgentDB learning store — a persistent pattern repository that influences future AI-generated output across sessions. Noma Labs showed that an attacker can inject malicious patterns into this store. For their proof of concept, they planted a fake SOC2 compliance policy that instructed the AI to include an attacker-controlled URL in all generated deployment scripts.
“The ability to write malicious instructions into a platform’s persistent AI memory means an attacker can influence the responses that AI gives to every future user of the platform, long after the original intrusion has ended,” Noma said in its disclosure.
The critical detail: a patched redeploy does not undo the poisoning. The AgentDB pattern store retains its entries across updates. Operators must manually audit and purge injected patterns — a remediation step that most incident response playbooks do not cover.
“For organizations exposed to a vulnerability like this, remediation requires more than a software update,” Noma said. “AI provider credentials should be treated as compromised and rotated, the platform’s AI memory should be audited for tampering, and containers should be rebuilt from a clean image.”
Vendor Response
Ruflo’s maintainer, Reuven Cohen, merged a fix within hours of Noma Labs’ responsible disclosure on June 30, 2026. The public advisory (GHSA-c4hm-4h84-2cf3) was published July 1, and Noma’s detailed blog post followed July 29.
“The MCP bridge shipping in ruflo/docker-compose.yml exposed POST /mcp with no authentication,” Cohen said in the release notes. “The docker-compose defaults bound the bridge and MongoDB to all interfaces.”
The fixes in ADR-166 addressed every vector in the chain: the MCP bridge now binds to loopback by default and fails closed if operators attempt public binding without setting MCP_AUTH_TOKEN; bearer authentication uses constant-time comparison; terminal_execute is gated behind an opt-in flag; MongoDB requires authentication on boot; the container runs read-only with tmpfs; and CI regression tests prevent these defaults from slipping back.
The MCP Wave Continues
Ruflo has approximately 10 million downloads and 1 million active users. The platform is commonly self-hosted — developers clone the repository, add their LLM API keys, and run docker compose up -d to spin up a fully functional AI agent platform. The default docker-compose.yml binds port 3001 to 0.0.0.0, exposing the bridge on all network interfaces.
CVE-2026-59726 is the seventh distinct MCP attack vector disclosed in four months, joining the Kiro prompt injection, AgentBaiting supply chain campaign, AWS Bedrock AgentCore sandbox escape, Azure DevOps MCP injection, HashiCorp Terraform MCP credential reuse, and RufRoot itself. The pattern is becoming structural: MCP’s design — direct tool access for LLMs — creates high-stakes security boundaries that default deployments consistently fail to protect.
Operators running exposed Ruflo instances should immediately firewall ports 3001 and 27017, upgrade to Ruflo 3.16.3 or later, rotate all LLM API keys, audit the AgentDB pattern store for injected entries, and audit MongoDB for tampering.