- A maximum-severity vulnerability (CVE-2026-59726, CVSS 10.0) in the open-source AI agent platform Ruflo allows unauthenticated remote code execution.
- The flaw, codenamed RufRoot, exploits an unauthenticated Model Context Protocol bridge exposed on port 3001 by default in docker-compose deployments.
- Attackers can gain shell access, steal LLM API keys, poison AI memory, and deploy persistent backdoors.
- The maintainer released a fix in version 3.16.3 within 24 hours of disclosure, binding the bridge to loopback and enabling authentication.
- Operators must close exposed ports, rotate all API keys, audit the AgentDB for tampering, and rebuild containers from clean images.
Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo, an open-source AI agent meta-harness, that could lead to unauthenticated remote code execution. The vulnerability, tracked as CVE-2026-59726 (CVSS score 10.0), impacts all versions before 3.16.3 and has been codenamed RufRoot by Noma Security’s research team.
The crux of the issue is that Ruflo exposed 233 tools through an unauthenticated Model Context Protocol bridge open to the network by default. Specifically, the docker-compose.yml configuration binds port 3001 to 0.0.0.0, making any network-reachable instance fully exploitable without authentication.
Consequently, a single unauthenticated HTTP POST to port 3001 can invoke the terminal_execute tool and obtain a shell inside the bridge container. Armed with this foothold, an attacker could siphon API keys used to interact with LLM providers, read every user conversation, and interfere with the AI system’s memory to influence model responses.
Following responsible disclosure on June 30, 2026, the project’s maintainer, Reuven Cohen, pushed a fix within 24 hours. The patch now binds the MCP bridge to the loopback interface, gates terminal_execute behind server-side controls, and enables MongoDB authentication.
Operators running exposed instances are recommended to immediately close firewall ports 3001 and 27017, rotate all LLM API keys, and audit the AgentDB pattern store for injected entries. Noma warned that the ability to write malicious instructions into persistent AI memory means an attacker can influence responses to every future user, long after the original intrusion ends.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- Micron Stock August Target in Doubt After AI Rally Selloff
- Pompliano: Banks battle crypto firms over who can offer yield
- Bitcoin Struggles as Musk Prediction Looms, Fed Meeting Awaited
- Emirates launches crypto payments for flights via Crypto.com
- Firefox JIT bug CVE-2026-10702 exploited via malicious webpage
