A serious vulnerability within the open-source AI agent platform Ruflo enables attackers without authentication to commandeer enterprise AI environments. This security flaw, tracked as CVE-2026-59726 and termed RufRoot, carries a critical CVSS score of 10.0, impacting all versions prior to 3.16.3, as highlighted by Noma Security in their findings.
The exploit permits intruders to execute arbitrary code, access API keys for large language models (LLMs), retrieve user conversations, and manipulate Ruflo’s persistent AI memory through a single HTTP request. The problem arises from a default exposure of the Model Context Protocol (MCP) bridge, which provides direct access to the critical tools used by AI agents.
As the researchers pointed out, “The MCP Bridge isn’t just an auxiliary debug interface; it acts as Ruflo’s central nervous system. Any unauthorized access means unrestricted access to all functionalities.” This makes the flaw particularly alarming since it compromises the core of Ruflo’s infrastructure.
One Request Leads to Full Compromise
Noma Security elaborates that Ruflo’s built-in MCP Bridge runs on an Express.js server, managing every tool invocation made by AI agents. This bridge exposes a total of 233 tools that cover shell commands, database operations, agent management, and memory storage.
Alarmingly, the bridge’s /mcp endpoint accepts requests without authentication. During their proof-of-concept demonstration, researchers executed shell commands within a container using the terminal_execute tool via a single HTTP request. They noted, “The MCP Bridge's direct access to underlying system resources creates a high-stakes security boundary. If an attacker reaches this point unauthenticated, they get direct access to the underlying infrastructure.”
The assessment showed that the vulnerability could be exploited to enumerate available tools, steal LLM API keys from environment variables, deploy malicious AI agents, access user conversation logs stored in MongoDB, and establish persistent access. Furthermore, the researchers demonstrated what they called AI memory poisoning by inserting malicious entries into Ruflo’s AgentDB pattern store, thereby influencing future AI responses.
Beyond Ruflo: A Broader MCP Security Challenge
While the authentication issue is specific to Ruflo, it underscores larger concerns for AI orchestration platforms and MCP infrastructures. Amit Jena, AI Development Manager at Kanerika, remarked, “MCP adoption has exceeded the security protocols in many orchestration tools. These systems were shipping quickly and prioritized ease of setup over robust authentication, assuming the network boundary would suffice.” This assumption falters when these tools are deployed on servers accessible via corporate networks.
Jena highlighted the pervasive nature of the memory poisoning problem. This concern transcends a single platform: “Any system allowing agents a persistent, writable memory store needs to consider it a security boundary. Very few platforms enforce such restrictions today.” He emphasized that unlike traditional persistence methods, poisoned AI memory can linger in trusted data stores, influencing agent behavior long after an initial breach.
Patch Addresses Attack Chain
In response to the findings, Noma Security responsibly disclosed the vulnerability to Ruflo, which swiftly released fixes and a public security advisory. The updated release binds the MCP Bridge to the loopback interface by default and ensures it fails securely if exposed without proper authentication.
Noma Security has urged organizations using Ruflo to take immediate action: close firewall access to ports 3001 and 27017, rotate all LLM API keys, audit the AgentDB for malicious entries since “a patched redeploy alone doesn’t undo poisoning,” and inspect MongoDB for any signs of tampering.
Jena advises that organizations reassess their deployment and management strategies for AI orchestration platforms. “Components capable of executing shell commands or querying databases should receive the same authentication measures, network segmentation, and logging as other privileged systems within the environment,” he stated. Furthermore, he recommends conducting inventories of tools exposed through AI deployments, auditing persistent AI memory independently of software updates, and tightening the scopes around LLM provider credentials following any suspected breaches.
