Unauthenticated attackers could exploit a critical-severity vulnerability in the open source AI agent orchestration platform Ruflo to execute commands inside the container, Noma Labs security researchers warn.
A popular automation assistant with over 67,000 GitHub stars, Ruflo (formerly Claude Flow) comes with a multi-model AI chat interface, agent swarms, persistent memory, and built-in Model Context Protocol (MCP) tool calling.
Ruflo allows organizations to use AI applications, courtesy of agent swarms (support for coordinating up to 100 agents on shared enterprise-grade tasks), long-term memory enabling agents to recall past interactions, and an integrated MCP server enabling agents to execute various tasks.
“The bridge exposes 233 tools covering shell access, database operations, agent management, and memory storage, making it the single point through which every agent action flows. Because the MCP Bridge requires direct access to the underlying system resources to execute these commands, it creates a high-stakes security boundary,” Noma explains.
Tracked as CVE-2026-59726 (CVSS score of 10/10), the security defect was found in the MCP bridge in ruflo/docker-compose.yml, which exposed the POST /mcp endpoint without authentication.
Because in default docker-compose deployments the bridge and MongoDB were bound to all interfaces, an unauthenticated attacker could invoke terminal_execute to run commands inside the bridge container, Ruflo’s advisory reads.
Successful exploitation of the bug could allow the attacker to gain shell access as node, read provider API keys, spawn swarms on the victim’s keys, and inject poison patterns into the AgentDB learning store to tamper with the AI outputs for all users.
According to Noma, which named the bug RufRoot, the root cause is that, in self-hosted deployments, the docker-compose.yml binds port 3001 to 0.0.0.0 by default, exposing all network-reachable instances to exploitation without authentication.
“The MCP Bridge isn’t a random auxiliary debug interface; rather, it is Ruflo’s central nervous system. Every tool call, every agent action, every memory operation goes through the MCP Bridge. Mistakenly giving unauthenticated access to the MCP Bridge means giving unauthenticated access to everything,” Noma explains.
With a single HTTP request targeting ruflo__terminal_execute, an attacker could take over the agent swarm, because the command would run as the container’s node user, providing access to all accessible assets without further escalation.
“Once you have command execution, achieving full compromise is just chaining more requests to the same endpoint,” Noma explains.
An attacker could exploit the vulnerability for reconnaissance, remote code execution (RCE), API key and conversation theft, spawning attacker-controlled agent swarms, poisoning the learning pipeline to produce attacker-influenced output, deploying persistent backdoors, and clearing shell history to remove traces.
The vulnerability was patched in Ruflo version 3.16.3. The fix addresses all attack vectors, and Ruflo’s maintainers published remediation steps for users with exposed instances.
Related: Chrome 151 Patches 370 Vulnerabilities
Related: Cisco Secure FMC Zero-Day Exploited in the Wild
Related: JFrog Zero-Days Exploited in OpenAI-Hugging Face Hack
Related: Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day
