Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex, that could result in unauthenticated remote code execution.
The vulnerability, tracked as CVE-2026-59726 (CVSS score: 10.0), impacts all versions of the project before version 3.16.3. It has been codenamed RufRoot by Noma Security’s research team, Noma Labs.
Originally launched as Claude Flow, Ruflo is an AI multi-agent orchestration platform and harness that allows users to deploy multi-player swarms, coordinate autonomous workflows, and build conversational AI systems. The project has more than 66,500 stars on GitHub.
The crux of the vulnerability is that Ruflo exposed 233 tools, including shell command execution, database operations, agent management, and memory storage, through an unauthenticated Model Context Protocol (MCP) bridge that’s open to the network by default.
Specifically, the “docker-compose.yml” YAML configuration file was found to bind port 3001 to 0.0.0.0 by default, exposing the bridge on all network interfaces. That said, the extent of exposure depends on the deployment’s firewall rules, security groups, and network segmentation. It’s worth noting that any network-reachable instance is fully exploitable without authentication.
As a result, a single unauthenticated HTTP POST to port 3001 made it possible to gain full remote code execution inside a susceptible Ruflo deployment, per security researcher Eli Ainhorn –
curl -s -X POST https://:3001/mcp -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"ruflo__terminal_execute","arguments":{"command":"id && hostname"}}}' Armed with this foothold, an attacker could siphon the API keys Ruflo uses to interact with large language model (LLM) providers, read every user conversation stored on the platform, and interfere with the AI system’s memory to influence model responses and behavior.
In other words, command execution serves as a stepping stone for full compromise, enabling LLM API key theft, agent weaponization, AI memory poisoning, conversation harvesting, and persistent backdoor deployment by writing a malicious payload to the “/app” directory.
“Prior to 3.16.3, Ruflo’s default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns,” according to a description of the flaw in NIST’s National Vulnerability Database (NVD).
Following responsible disclosure on June 30, 2026, a fix for the vulnerability was pushed by the project’s maintainer, Reuven Cohen, within 24 hours. As part of the patch, the MCP bridge now binds to the loopback interface by default, gates “terminal_execute” behind server-side executeTool controls, and enables MongoDB authentication to prevent conversation theft, among others.
“The MCP bridge shipping in ruflo/docker-compose.yml exposed POST /mcp with no authentication,” Cohen said in the release notes. “The docker-compose defaults bound the bridge and MongoDB to all interfaces.”
“Combined, an unauthenticated network attacker could invoke tools/call → terminal_execute inside the bridge container, obtain a shell, read every provider API key from the container env, spawn attacker-controlled swarms on the victim’s keys, and persist a poisoned pattern into the AgentDB learning store that steers future AI outputs.”
Operators running an exposed instance are recommended to immediately close firewall ports 3001 and 27017, rotate all LLM API keys, audit the AgentDB pattern store for injected agentdb_pattern-store entries, and check MongoDB for signs of tampering.
“The Ruflo vulnerability enabled spinning up a swarm of agents to do whatever the attacker wanted and even tamper with the AI’s memory,” Noma said. “The ability to write malicious instructions into a platform’s persistent AI memory means an attacker can influence the responses that AI gives to every future user of the platform, long after the original intrusion has ended.”
“For organizations exposed to a vulnerability like this, remediation requires more than a software update. AI provider credentials should be treated as compromised and rotated, the platform’s AI memory should be audited for tampering, and containers should be rebuilt from a clean image.”
