RufRoot CVE-2026-59726: Unauthenticated RCE in Ruflo MCP Bridge Exposes AI Agent Keys
A single unauthenticated POST request was sufficient to open a command shell inside one of the most widely deployed AI agent orchestration platforms on GitHub. From that foothold, an attacker could steal API keys for OpenAI and Anthropic, read user conversations, spawn adversary-controlled agent swarms, and embed malicious instructions into the system’s persistent memory – all without a password, token, or any form of identity verification.
The Vulnerability: CVE-2026-59726 in Ruflo
Researchers at Noma Labs discovered the critical flaw, designated RufRoot and tracked as CVE-2026-59726 in their full technical write-up, within the open-source Ruflo platform. The vulnerability received a CVSS score of 10.0 – the highest possible rating – and affected all Ruflo releases prior to version 3.16.3.
Ruflo enables developers to build coordinated groups of AI agents, maintain context across sessions, and connect external tools through the Model Context Protocol. At the time the research was published, the project had accumulated more than 67,000 GitHub stars.
The MCP Bridge: 233 Functions, Zero Authentication
The platform’s central component is the MCP Bridge – an Express.js server through which all tool calls and agent actions are routed. This single component exposed 233 distinct functions, spanning agent management, memory operations, database queries, and in-container command execution.
The default Docker Compose configuration bound port 3001 to all network interfaces. While reachability from the public internet depended on firewall rules and cloud security group settings, any party with network access to the MCP Bridge could issue commands without supplying a token, API key, or any other credential.
The Vulnerable Endpoint
The POST /mcp endpoint accepted JSON-RPC requests and forwarded them directly to the executeTool() function. Ruflo maintained a blocklist of patterns intended to prohibit dangerous commands – but that restriction applied exclusively to autopilot mode. Direct calls to the MCP Bridge bypassed the protection entirely.
Among the exposed functions was ruflo__terminal_execute, which launched arbitrary operating system commands inside the container under the node user account with UID 1000. A single HTTP request was sufficient to achieve code execution. No privilege escalation was necessary, because the process already held access to environment variables, agent interfaces, persistent memory, and the database.
What an Attacker Could Steal
Environment variables stored inside the container contained API keys for every connected external service. The list of potentially accessible credentials included keys for OpenAI, Anthropic, Google, and OpenRouter. Stolen keys could be immediately repurposed to run adversary-controlled agent fleets at the victim’s expense.
An Eight-Stage Attack Chain Validated on AWS
Noma Labs constructed and validated an eight-stage automated attack chain against a standard Ruflo deployment running on AWS EC2. The sequence proceeded as follows: enumerate available tools; execute arbitrary commands; extract AI provider keys; create attacker-controlled agents; and exfiltrate conversation history from MongoDB.
The MongoDB instance operated on the Docker internal network without mandatory authentication. After obtaining a shell, the attacker could install a database client in a temporary directory, copy message content, conversation titles, and associated metadata, then transmit the data to an external server.
Persistent Memory Poisoning
Synack’s analysis of the RufRoot attack surface highlighted a particularly insidious dimension of the vulnerability: the corruption of AgentDB, Ruflo’s persistent memory store.
An attacker could write a malicious rule into agent memory – for example, an instruction to append an attacker-controlled address to every deployment script the agent generates. This injected directive would influence all subsequent agent responses and survive a container update undetected.
Critically, patching the code does not restore the integrity of a compromised memory store. A malicious entry may have been transformed during processing, propagated into other templates, or replicated across multiple locations. Administrators must audit and purge AgentDB independently of applying the software fix.
Backdoor Installation via the /app Directory
Researchers also demonstrated how a persistent backdoor could be installed without touching protected files. Although the primary index.js file was write-protected, the /app directory permitted the creation of new files. An attacker could write a malicious script there, hook it into the container startup sequence, and terminate the primary process. Docker’s restart: unless-stopped policy would then automatically relaunch Ruflo – along with the embedded backdoor.
The Fix: Version 3.16.3
Coinkite addressed the vulnerability in Ruflo 3.16.3. Under the updated configuration, the MCP Bridge binds exclusively to localhost by default. Public exposure now requires an explicitly set MCP_AUTH_TOKEN, and command execution via terminal_execute remains disabled unless MCP_ENABLE_TERMINAL=true is deliberately configured.
The accompanying ADR-166 patch introduced mandatory MongoDB authentication, switched the container to read-only mode, mounted a tmpfs temporary filesystem, tightened CORS origin restrictions, and added automated tests to flag insecure configurations before deployment.
Immediate Actions for Exposed Installations
Owners of network-accessible Ruflo instances should take the following steps without delay. First, close ports 3001 and 27017 at the network perimeter. Second, upgrade to at least version 3.16.3. Third, rotate every API key that was present in the container environment. Fourth, audit MongoDB for unauthorized data access. Fifth, inspect AgentDB and remove any entries that were not legitimately created.
A Lesson in AI Infrastructure Security
RufRoot did not exploit a language model, bypass a safety filter, or manipulate an agent through a crafted user prompt. The attack targeted the infrastructure surrounding the agents: the network service, the tool interfaces, the container, the credentials, the database, and the persistent memory layer.
Even after applying the patch, owners of previously compromised installations cannot consider a fresh container deployment sufficient remediation. The corrected version closes the vulnerable entry point – but it does not retrieve keys that were exfiltrated, conversations that were copied, or malicious instructions that were written into agent memory before the breach was discovered.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
