RufRoot (CVE-2026-59726): Unauthenticated Remote Code Execution via Ruflo's MCP Bridge, CVSS 10.0

TL;DR in 90 seconds

Affected?

Ruflo deployments where the MCP Bridge (default port 3001) is reachable from the network. Per the default Docker Compose configuration, that's every unmodified installation.

Risk?

Unauthenticated remote code execution (CVSS 10.0) via POST /mcp and the ruflo__terminal_execute tool: no login, no token, no user interaction required. Noma Security demonstrated a full compromise chain through API key theft, database access, and a persistent backdoor.

Immediate action?

Take port 3001 (and 27017 for the bundled MongoDB) off the public network, update to the fixed version (PR #2521 / GHSA-c4hm-4h84-2cf3), and set MCP_AUTH_TOKEN.

Recommendation?

Act immediately if a Ruflo instance is reachable. This is trivially exploitable (a single curl request) and delivers direct code execution.

Criticality?

critical (hero badge): CVSS 10.0, unauthenticated, trivial exploit; the source base so far rests on a single security vendor (Noma Security), and we have no confirmation of active exploitation in the wild.

What is the problem?

Ruflo is an open-source platform for orchestrating AI agents: developers build “agentic swarms” of up to 100 collaborating agents with persistent memory across sessions and tool execution via the Model Context Protocol (MCP). The MCP Bridge is the central Express.js server through which external MCP clients (agents, tools, IDEs) reach Ruflo's 233 available tools, including shell access, database operations, agent management, and memory operations.

The POST /mcp endpoint implements the MCP JSON-RPC protocol and forwards tool calls directly to executeTool(), with no authentication layer at all. A command blocklist (AUTOPILOT_BLOCKED_PATTERNS) does exist and restricts dangerous operations, but only within the application's autopilot flow. The direct /mcp endpoint bypasses this check entirely. Combined with the default bind to 0.0.0.0 in the bundled docker-compose.yml (port 3001 on all network interfaces), the result is unauthenticated remote code execution with a single HTTP request:

curl -s -X POST <target>/mcp -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"ruflo__terminal_execute","arguments":{"command":"id && hostname"}}}'

Who is affected?

Particularly relevant for organisations running Ruflo experimentally or in production for internal automation, coding agents, or workflow orchestration: the default configuration prioritises setup simplicity over security, a pattern that has repeatedly led to critical vulnerabilities in AI agent tooling over the past months (comparable to the Langflow and LiteLLM cases already documented on this blog).

Impact

Noma Security demonstrated a full eight-step attack chain: (1) reconnaissance via tools/list, enumerating all 233 available tools; (2) code execution via terminal_execute; (3) theft of API keys from environment variables (OpenAI, Anthropic, Google, and OpenRouter credentials were reachable in the demonstrated environment); (4) “weaponizing” further agents via ruflo__swarm_init and ruflo__agent_spawn to spin up attacker-controlled swarms; (5) memory poisoning by injecting manipulated patterns into the learning pipeline via ruflo__agentdb_pattern-store; (6) data theft through unauthenticated access to the underlying MongoDB (dumping all conversations); (7) persistence by injecting a beacon script at /app/beacon.js with a startup hook; (8) covering tracks by clearing shell history.

The effect therefore goes well beyond classic server compromise: alongside full code execution, possible consequences include stolen LLM API keys, compromised agent swarms, and manipulated behaviour patterns permanently embedded in the learning pipeline. The latter is especially hard to fully clean up, since affected patterns can continue influencing downstream agent decisions.

Mitigation / immediate steps

Operational decision block

• Act today if … a Ruflo MCP Bridge (port 3001) is reachable from the internet or an untrusted internal network.
• Check with priority if … Ruflo is used internally and you're not sure whether MCP_AUTH_TOKEN is set.
• Monitor if … you've already updated to the patched line, MCP_AUTH_TOKEN is set, and the bridge isn't publicly reachable.

Step 1: Immediately restrict network access

# Firewall rules for the MCP bridge and its MongoDB backend
sudo ufw deny 3001/tcp
sudo ufw deny 27017/tcp

# If using Docker Compose: restrict the port mapping to localhost
# instead of "3001:3001" -> "127.0.0.1:3001:3001" in docker-compose.yml

Step 2: Update to the patched line

# Update Ruflo to the state after PR #2521 / GHSA-c4hm-4h84-2cf3
git pull
# or: pull the current release image that includes the fix

# Set the mandatory authentication environment variable
export MCP_AUTH_TOKEN="$(openssl rand -hex 32)"

# Terminal access remains disabled by default after the patch;
# only enable explicitly if strictly required:
# export MCP_ENABLE_TERMINAL=true

Step 3: Verify after patching

# Test unauthenticated access -- should fail after the patch
curl -s -X POST <host>/mcp -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
# expected response: error/rejection due to missing authentication,
# not the list of 233 tools

Detection / verification

Establish inventory

# Check whether a Ruflo MCP bridge is reachable on port 3001
nmap -p 3001 <host-or-range>

# Test unauthenticated access (only against your own systems!)
curl -s -X POST <host>/mcp -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
# If you get back a list of ~233 tools, the instance is vulnerable

Check for compromise

# Check for suspicious files that could serve as a backdoor
ls -la /app/beacon.js 2>/dev/null && echo "SUSPICIOUS: beacon.js found"

# Check MongoDB for unauthorized access/tampering
# (Ruflo's backend DB, default port 27017 -- review access logs)

# Check shell history for gaps/tampering (attackers typically clear traces)
history | tail -100
cat ~/.bash_history | wc -l

Runtime indicators

• Unexpected outbound connections from the Ruflo bridge process (API key exfiltration)
• New or unexpected entries in ruflo__agentdb_pattern-store (memory poisoning)
• Unknown agent swarms created via swarm_init/agent_spawn that weren't intentional
• Unusually high usage of LLM API quotas (OpenAI/Anthropic/Google/OpenRouter) outside known workloads

Operator guidance

Mid-market

Check immediately whether Ruflo is in use anywhere, including as a “shadow IT” experiment run by individual teams outside the official software inventory. If an instance is reachable, take port 3001/27017 off the public network immediately and update to the patched line. As a precaution, rotate all LLM API keys that were configured in the Ruflo environment, regardless of whether compromise is confirmed.

Enterprise

This case underlines a recurring pattern in AI agent tooling: frameworks optimised for fast onboarding often bind management and control interfaces to all network interfaces by default and skip authentication “for simplicity.” Build an inventory of all MCP servers and agent-orchestration tools across the organisation (officially adopted or not) and explicitly check their default configuration for open management ports before they go into production.

Decision block

• Act immediately: secure port 3001/27017, update to the patched line, set MCP_AUTH_TOKEN.
• Additionally: rotate LLM API keys, check AgentDB and MongoDB for tampering.
• Watch: further advisories about similar MCP bridge patterns in other agent-orchestration frameworks. The architectural problem (an open management API without auth) is not specific to Ruflo.

Conclusion

RufRoot is another example of a pattern that has repeated across AI agent tooling in recent months: a control interface meant for machine rather than human clients ships without authentication for simplicity's sake, under the tacit assumption that it won't be publicly reachable anyway. That assumption rarely holds in practice: default Docker Compose configurations often bind ports to all interfaces, and “internal only” quickly becomes “reachable from the internet” the moment a cloud provider, a NAT gateway, or a misconfigured load balancer enters the picture. The architectural lesson is the same as in the Langflow and LiteLLM cases already documented on this blog: any management or tool-execution interface of an AI agent framework is a production, privileged service and must be treated as such from day one: with authentication by default, not as an afterthought.

Sources

• Noma Security — RufRoot: The MCP Bridge Vulnerability That Turns Agents Into Rogue Admins (CVE-2026-59726)

Note: the technical detail in this post rests on a single security vendor as a source. We did not find an independent second source (e.g. an NVD entry or Ruflo's own advisory page) confirming these details at the time of research. Check the original advisory and Ruflo's GitHub repository (GHSA-c4hm-4h84-2cf3, PR #2521) for current information before making operational decisions.