Critical Ruflo Vulnerability (CVE-2026-59726) Allows AI Swarm Hijacking and RCE

Self-hosted deployments of the popular open-source AI agent orchestration framework Ruflo are vulnerable to unauthenticated remote code execution and full system compromise. Tracked as CVE-2026-59726 with a maximum CVSS score of 10.0, the Ruflo vulnerability—dubbed “RufRoot” by security researchers at Noma Labs—allows attackers to invoke container shell commands, harvest model API keys, and poison persistent memory stores by issuing a single HTTP request to an exposed endpoint.

Ruflo, previously known as Claude Flow, has accumulated over 67,000 stars on GitHub due to its ability to coordinate up to 100 autonomous AI agents on complex enterprise tasks. To perform actions across external databases and host OS environments, the platform relies on Model Context Protocol (MCP) integrations operated through a central MCP bridge.

Technical Root Cause of RufRoot

The flaw exists within the default configuration provided in the official ruflo/docker-compose.yml file. By default, self-hosted deployments bound port 3001—which serves the MCP bridge API—to all network interfaces (0.0.0.0). Additionally, the underlying MongoDB instance and bridge infrastructure were left exposed without enforcing authentication mechanisms on incoming HTTP interactions.

The MCP bridge functions as Ruflo’s operational control plane, exposing 233 internal tools that handle shell execution, database manipulation, agent lifecycle management, and memory storage. Because tool execution requires raw host and container privileges, the bridge container operates as a primary security boundary.

Under pre-patch default configurations, an unauthenticated remote attacker who can reach port 3001 can send a POST request to the exposed /mcp endpoint and execute the ruflo__terminal_execute function. Because the request executes under the privileges of the container’s standard node user, the attacker gains immediate, unauthenticated command execution inside the container without needing to bypass initial access controls or escalate privileges.

POST /mcp HTTP/1.1
Host: target-ruflo-instance:3001
Content-Type: application/json

{
  "tool": "ruflo__terminal_execute",
  "parameters": {
    "command": "whoami"
  }
}

Once arbitrary command execution is achieved through this endpoint, further compromise of the agent deployment can be driven entirely through follow-up HTTP requests to the same vulnerable bridge.

Threat Vectors and Blast Radius

Because AI agent orchestrators maintain high-level credentials to interact with third-party model providers, vector databases, and enterprise applications, compromising the MCP bridge provides access to high-value targets across the host environment:

• API Key Exfiltration: Container memory and environment configurations host sensitive third-party provider credentials (such as Anthropic or OpenAI API keys). Attackers can extract these secrets to make unauthorized API calls at the victim’s expense or gain access to broader cloud platform subscriptions.
• Agent Swarm Hijacking: Unauthorized actors can spawn, modify, or commandeer agent swarms, redirecting background worker threads to run unauthorized LLM workloads or siphon sensitive data from internal systems.
• AgentDB Poisoning: Ruflo utilizes long-term memory via its AgentDB learning store to maintain context across historical agent interactions. An attacker with shell access can inject poisoned context patterns into the memory database, corrupting future model inference, skewing output reliability, or introducing prompt-injection logic into routines shared across the enterprise.
• Data Theft and Eavesdropping: Intruders can view conversational histories, sensitive prompt logs, internal business documents, and system state snapshots accessible to the agent cluster.
• Persistence and Forensics Avoidance: Attackers can deploy persistent reverse shells inside the bridge container and clear shell history files (such as .bash_history) to cover their tracks.

Because many organizations deploy AI orchestration engines inside environments with direct access to internal source code repositories, intranet databases, and corporate APIs, an unauthenticated RCE on the MCP bridge acts as a entry point for broader internal network pivot attempts.

Remediation Guidance

The maintainers of Ruflo have released version 3.16.3, which addresses the vulnerability by enforcing strict access controls and modifying default network exposure settings.

1. Apply Software Updates: Upgrade all Ruflo instances to version 3.16.3 or later immediately.
2. Restrict Interface Bindings: Inspect your docker-compose.yml deployment files to ensure port 3001 and database ports (such as MongoDB port 27017) are bound strictly to loopback interfaces (127.0.0.1) rather than 0.0.0.0.
3. Implement Network Edge Protections: If the MCP bridge interface must be accessed across host boundaries, place the service behind an authenticating reverse proxy or VPN access layer, enforcing explicit API key or mutual TLS (mTLS) verification.
4. Credential Rotation: Organizations that operated internet-facing, unpatched Ruflo instances prior to version 3.16.3 should treat all API keys, database credentials, and session tokens stored within the container environment as potentially compromised and rotate them immediately.