Cybersecurity researchers have flagged a maximum-severity safety flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex, that might end in unauthenticated distant code execution.
The vulnerability, tracked as CVE-2026-59726 (CVSS rating: 10.0), impacts all variations of the venture earlier than model 3.16.3. It has been codenamed RufRoot by Noma Safety’s analysis group, Noma Labs.
Initially launched as Claude Circulate, Ruflo is an AI multi-agent orchestration platform and harness that enables customers to deploy multi-player swarms, coordinate autonomous workflows, and construct conversational AI techniques. The venture has greater than 66,500 stars on GitHub.
The crux of the vulnerability is that Ruflo uncovered 233 instruments, together with shell command execution, database operations, agent administration, and reminiscence storage, by an unauthenticated Mannequin Context Protocol (MCP) bridge that is open to the community by default.
Particularly, the “docker-compose.yml” YAML configuration file was discovered to bind port 3001 to 0.0.0.0 by default, exposing the bridge on all community interfaces. That stated, the extent of publicity relies on the deployment’s firewall guidelines, safety teams, and community segmentation. It is price noting that any network-reachable occasion is totally exploitable with out authentication.
Because of this, a single unauthenticated HTTP POST to port 3001 made it potential to realize full distant code execution inside a prone Ruflo deployment, per safety researcher Eli Ainhorn –
curl -s -X POST https://:3001/mcp -H "Content material-Kind: utility/json" -d '{"jsonrpc":"2.0","id":1,"methodology":"instruments/name","params":{"identify":"ruflo__terminal_execute","arguments":{"command":"id && hostname"}}}' Armed with this foothold, an attacker might siphon the API keys Ruflo makes use of to work together with massive language mannequin (LLM) suppliers, learn each consumer dialog saved on the platform, and intervene with the AI system’s reminiscence to affect mannequin responses and conduct.
In different phrases, command execution serves as a stepping stone for full compromise, enabling LLM API key theft, agent weaponization, AI reminiscence poisoning, dialog harvesting, and chronic backdoor deployment by writing a malicious payload to the “/app” listing.
“Prior to three.16.3, Ruflo’s default docker-compose deployment uncovered the MCP bridge POST /mcp and POST /mcp/:group endpoints with out authentication, permitting an unauthenticated community attacker to invoke instruments/name to terminal_execute, acquire a shell within the bridge container, learn supplier API keys, and poison AgentDB learning-store patterns,” based on a description of the flaw in NIST’s Nationwide Vulnerability Database (NVD).
Following accountable disclosure on June 30, 2026, a repair for the vulnerability was pushed by the venture’s maintainer, Reuven Cohen, inside 24 hours. As a part of the patch, the MCP bridge now binds to the loopback interface by default, gates “terminal_execute” behind server-side executeTool controls, and permits MongoDB authentication to forestall dialog theft, amongst others.
“The MCP bridge delivery in ruflo/docker-compose.yml uncovered POST /mcp with no authentication,” Cohen stated within the launch notes. “The docker-compose defaults certain the bridge and MongoDB to all interfaces.”
“Mixed, an unauthenticated community attacker might invoke instruments/name → terminal_execute contained in the bridge container, acquire a shell, learn each supplier API key from the container env, spawn attacker-controlled swarms on the sufferer’s keys, and persist a poisoned sample into the AgentDB studying retailer that steers future AI outputs.”
Operators operating an uncovered occasion are really useful to right away shut firewall ports 3001 and 27017, rotate all LLM API keys, audit the AgentDB sample retailer for injected agentdb_pattern-store entries, and test MongoDB for indicators of tampering.
“The Ruflo vulnerability enabled spinning up a swarm of brokers to do regardless of the attacker wished and even tamper with the AI’s reminiscence,” Noma stated. “The flexibility to put in writing malicious directions right into a platform’s persistent AI reminiscence means an attacker can affect the responses that AI offers to each future consumer of the platform, lengthy after the unique intrusion has ended.”
“For organizations uncovered to a vulnerability like this, remediation requires greater than a software program replace. AI supplier credentials needs to be handled as compromised and rotated, the platform’s AI reminiscence needs to be audited for tampering, and containers needs to be rebuilt from a clear picture.”
