{"id":2087,"date":"2026-07-29T16:11:02","date_gmt":"2026-07-29T16:11:02","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2087"},"modified":"2026-07-29T16:11:02","modified_gmt":"2026-07-29T16:11:02","slug":"ruflo-mcp-flaw-lets-unauthenticated-attackers-run-commands-and-poison-ai-memory","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2087","title":{"rendered":"Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory"},"content":{"rendered":"
\n
<\/a><\/div>\n

Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo<\/a>, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex, that could result in unauthenticated remote code execution.<\/p>\n

The vulnerability, tracked as CVE-2026-59726<\/a><\/strong> (CVSS score: 10.0), impacts all versions of the project before version 3.16.3. It has been codenamed RufRoot<\/a><\/strong> by Noma Security’s research team, Noma Labs.<\/p>\n

Originally launched as Claude Flow, Ruflo is an AI multi-agent orchestration platform and harness that allows users to deploy multi-player swarms, coordinate autonomous workflows, and build conversational AI systems. The project has more than 66,500 stars on GitHub.<\/p>\n

The crux of the vulnerability is that Ruflo exposed 233 tools, including shell command execution, database operations, agent management, and memory storage, through an unauthenticated Model Context Protocol (MCP) bridge that’s open to the network by default.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Specifically, the \u00abdocker-compose.yml\u00bb YAML configuration file was found to bind port 3001 to 0.0.0.0 by default, exposing the bridge on all network interfaces. That said, the extent of exposure depends on the deployment’s firewall rules, security groups, and network segmentation. It’s worth noting that any network-reachable instance is fully exploitable without authentication.<\/p>\n

<\/p>\n

As a result, a single unauthenticated HTTP POST to port 3001 made it possible to gain full remote code execution inside a susceptible Ruflo deployment, per security researcher Eli Ainhorn –<\/p>\n

curl -s -X POST https:\/\/:3001\/mcp -H \"Content-Type: application\/json\" -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools\/call\",\"params\":{\"name\":\"ruflo__terminal_execute\",\"arguments\":{\"command\":\"id && hostname\"}}}'<\/target><\/code><\/pre>\n
Armed with this foothold, an attacker could siphon the API keys Ruflo uses to interact with large language model (LLM) providers, read every user conversation stored on the platform, and interfere with the AI system’s memory to influence model responses and behavior.<\/p>\n
In other words, command execution serves as a stepping stone for full compromise, enabling LLM API key theft, agent weaponization, AI memory poisoning, conversation harvesting, and persistent backdoor deployment by writing a malicious payload to the \u00ab\/app\u00bb directory.<\/p>\n
\u00abPrior to 3.16.3, Ruflo’s default docker-compose deployment exposed the MCP bridge POST \/mcp and POST \/mcp\/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools\/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns,\u00bb according to a description<\/a> of the flaw in NIST’s National Vulnerability Database (NVD).<\/p>\n
Following responsible disclosure on June 30, 2026, a fix for the vulnerability<\/a> was pushed by the project’s maintainer, Reuven Cohen, within 24 hours. As part of the patch, the MCP bridge now binds to the loopback interface by default, gates \u00abterminal_execute\u00bb behind server-side executeTool controls, and enables MongoDB authentication to prevent conversation theft, among others.<\/p>\n
\u00abThe MCP bridge shipping in ruflo\/docker-compose.yml exposed POST \/mcp with no authentication,\u00bb Cohen said in the release notes. \u00abThe docker-compose defaults bound the bridge and MongoDB to all interfaces.\u00bb<\/p>\n
\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n
\u00abCombined, an unauthenticated network attacker could invoke tools\/call \u2192 terminal_execute inside the bridge container, obtain a shell, read every provider API key from the container env, spawn attacker-controlled swarms on the victim’s keys, and persist a poisoned pattern into the AgentDB learning store that steers future AI outputs.\u00bb<\/p>\n
Operators running an exposed instance are recommended to immediately close firewall ports 3001 and 27017, rotate all LLM API keys, audit the AgentDB pattern store for injected agentdb_pattern-store entries, and check MongoDB for signs of tampering.<\/p>\n
\u00abThe Ruflo vulnerability enabled spinning up a swarm of agents to do whatever the attacker wanted and even tamper with the AI’s memory,\u00bb Noma said. \u00abThe ability to write malicious instructions into a platform’s persistent AI memory means an attacker can influence the responses that AI gives to every future user of the platform, long after the original intrusion has ended.\u00bb<\/p>\n
\u00abFor organizations exposed to a vulnerability like this, remediation requires more than a software update. AI provider credentials should be treated as compromised and rotated, the platform’s AI memory should be audited for tampering, and containers should be rebuilt from a clean image.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex, that could result in unauthenticated remote code execution. The…<\/p>\n","protected":false},"author":1,"featured_media":2088,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[622,195,70,332,765,950,2796,2795,1774,725],"class_list":["post-2087","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-attackers","tag-commands","tag-flaw","tag-lets","tag-mcp","tag-memory","tag-poison","tag-ruflo","tag-run","tag-unauthenticated"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2087","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2087"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2087\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2088"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2087"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2087"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2087"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}