Unauthenticated RCE via Open MCP Bridge in Ruflo Agent Harness
CVSS 10.0: Ruflo's MCP bridge exposes 233 tool endpoints to unauth network access, enabling RCE, API key theft, and AI memory poisoning. Patched in 3.16.3.
- Vendor
- Ruflo
- Product
- Ruflo agent meta-harness (all versions before 3.16.3)
- CVSS
- 10.0
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
CVE-2026-59726, named RufRoot by Noma Security, is a maximum-severity vulnerability in Ruflo — an open-source Model Context Protocol harness for Anthropic Claude Code and OpenAI Codex. The flaw stems from a default docker-compose configuration that binds Ruflo’s MCP bridge to all network interfaces without requiring authentication, exposing 233 tool endpoints (shell execution, database operations, AI memory storage) to any network-reachable attacker.
Discovered by researcher Eli Ainhorn and disclosed June 30, 2026, the vulnerability allows an unauthenticated attacker to achieve remote code execution, harvest stored LLM API keys, extract conversation histories, and poison AI memory patterns in ways that can influence future model behavior.
Fix: Version 3.16.3 (released same day as disclosure) restricts the MCP bridge to localhost, gates terminal execution behind server-side controls, and enables MongoDB authentication. Any Ruflo instance that was network-accessible before the patch should be treated as potentially compromised — rotate API keys.
No active exploitation has been observed as of disclosure.
References: The Hacker News coverage · NVD entry
