RufRoot: Critical Vulnerability (CVSS 10.0) in Ruflo Opens Remote Shell Without Authentication

Introduction

On June 30, 2026, researchers at Noma Labs (Noma Security) disclosed a critical security flaw in the open-source Ruflo project, a popular multi-agent orchestration platform among AI developers (over 66,500 GitHub stars). Dubbed RufRoot and tracked as CVE-2026-59726, the vulnerability received a CVSS score of 10.0 – the maximum – because it allows remote arbitrary command execution on any reachable instance without requiring credentials. The maintainer released a patch in less than 24 hours, but all installations with a version prior to 3.16.3 remain at risk of total compromise.

Technical Analysis

The core of the problem lies in the default configuration of the MCP (Model Context Protocol) bridge included with Ruflo's Docker Compose files. The official image exposed port 3001/tcp on all network interfaces (0.0.0.0) without enabling any authentication mechanism. The MCP bridge serves as the connection point for invoking agent tools: Ruflo provides as many as 233 tools, including terminal_execute, which enables direct shell command execution inside the container.

An attacker can exploit the flaw simply by sending an unauthenticated HTTP POST request to the bridge endpoint. The payload allows execution of any command within the container context, effectively providing an interactive shell. Since containers are often run with elevated privileges or host access, compromise can quickly spread to the underlying infrastructure. The patch (version 3.16.3) addresses the issue on multiple levels: binds the MCP bridge to the loopback interface (127.0.0.1), introduces server-side checks on the terminal_execute tool, and enables authentication for MongoDB.

Impact

The consequences for a vulnerable instance are devastating and span multiple areas:

• Arbitrary Command Execution (RCE) – A single HTTP request allows full control over the container and, in many scenarios, the host node.
• Credential Theft – API keys for LLM providers (Anthropic, OpenAI, etc.) are readable from inside the container and are therefore completely exposed.
• AI Memory Poisoning – The attacker can inject malicious patterns into the AgentDB, Ruflo's persistent learning database, subtly altering the AI-generated responses for all future users.
• Data Exfiltration – Conversations, documents, and all content stored on the platform become accessible.
• Persistence and Backdoors – It is possible to write malicious payloads to the /app directory, create swarms of attacker-controlled agents, and maintain long-term access even after a restart.

Mitigation

To secure the environment, actions must be taken on multiple fronts:

1. Immediately update Ruflo to version 3.16.3 or later, where the MCP bridge is confined locally and command execution is verified.
2. Block network access to ports 3001 and 27017 (MongoDB) via firewall or security groups to prevent direct external access.
3. Rotate all API keys for LLM providers used in the configuration, considering them compromised.
4. Audit the AgentDB to identify suspicious entries in the pattern store and remove any injections.
5. Inspect MongoDB to verify collection integrity and check for unauthorized modifications.
6. Rebuild containers from a clean image, eliminating any persistent changes left by a potential attacker.

FAQ

1. What is Ruflo and why is it so widely adopted?
Ruflo (originally Claude Flow) is an open-source platform for AI agent orchestration, designed to simplify complex workflows integrating models like Claude Code and OpenAI Codex. With over 66,500 GitHub stars, it has become a go-to tool for developers and companies aiming to automate tasks via LLMs in both testing and production environments.

2. How do I know if my instance is vulnerable?
If you are running a Ruflo version below 3.16.3 and port 3001 is exposed on the public internet or an untrusted network, the instance is vulnerable. A practical symptom is that the MCP bridge responds to HTTP requests without an authentication token. As a precaution, however, it is strongly recommended to update and apply mitigations without waiting for invasive checks.

3. Beyond updating, what are the truly urgent steps?
After upgrading, immediately rotate all LLM provider API keys, as they should be considered compromised. Block network access to ports 3001 and 27017, and inspect the AgentDB for foreign commands or patterns. Finally, rebuild the containers from a clean official image and check MongoDB to ensure no malicious modifications have been introduced.