A newly identified vulnerability in the open-source AI platform Ruflo poses substantial risks, potentially enabling unauthorized actors to seize control of enterprise AI environments. This issue, referenced as CVE-2026-59726 or RufRoot, has been documented by Noma Security and carries a maximum CVSS score of 10.0, impacting versions of Ruflo prior to 3.16.3.
The flaw primarily resides within the Model Context Protocol (MCP) bridge, which is unintentionally exposed by default, granting direct access to the AI tools that interact with corporate systems. This vulnerability allows attackers to execute arbitrary code, access user data, hijack AI agents, and manipulate the persistent AI memory with a singular HTTP request.
Noma Security emphasized the central role of the MCP Bridge in the Ruflo ecosystem, describing it not just as another interface, but as "Ruflo’s central nervous system." Granting unauthenticated access compromises every aspect of system functionality, putting sensitive data at risk.
A Single Request Risks Total Control
Ruflo’s MCP Bridge operates as an Express.js server managing all tool executions made by AI agents, covering an extensive range of capabilities from database access to memory operations through 233 different tools.
Crucially, the /mcp endpoint of this bridge admits tool invocations without any form of authentication. In a proof-of-concept exercise, researchers demonstrated how they could trigger command execution inside a container with a single HTTP request via the terminal_execute tool.
The implications of this vulnerability are significant; once an attacker accesses the endpoint, they compromise the security boundary that should protect underlying system resources. Through this breach, attackers could list available tools, pilfer LLM provider API keys, deploy malicious AI agents, access user conversations housed in MongoDB, and set up persistent connections.
Moreover, the researchers identified a threat termed "AI memory poisoning," whereby they successfully inserted malicious data into Ruflo’s AgentDB pattern store. This led to manipulated AI responses potentially influenced by attacker directives in future interactions.
Wider MCP Security Implications
While Ruflo's vulnerability is the focal point, security experts assert that it reflects a broader problem facing AI orchestration platforms and MCP infrastructures. According to Amit Jena, AI Development Manager at Kanerika, “MCP adoption has outpaced the security defaults built into a lot of orchestration tools.” Historically, these platforms prioritize easy setup over robust authentication, relying on the assumption that a secure network perimeter suffices, a miscalculation given the increasing reach of internal networks.
Jena also cautioned that memory poisoning is not exclusive to Ruflo and should be a common concern: “Any platform with a writable memory store must establish clear security boundaries.” Notably, such poisoned memory can endure within trusted data environments, continuing to affect AI agents well after the initial breach.
Fixes Implemented for Rapid Response
In a proactive response to the vulnerability, Noma Security responsibly disclosed the issue to Ruflo, which managed to issue patches within hours, accompanied by a public security advisory. The update modifies the MCP Bridge to bind to the loopback interface by default and ensures that any public exposure attempts without proper authentication will fail securely.
Organizations utilizing Ruflo have been urged to take immediate action, including closing firewall access to ports 3001 and 27017, rotating all LLM API keys, auditing AgentDB for malicious inserts, and checking MongoDB for any signs of tampering. Additionally, Jena encourages a thorough evaluation of how AI orchestration platforms are implemented. Tools capable of executing shell commands or querying databases should be treated with equal security measures as other privileged systems.
Security teams should also assess the landscape of tools exposed through their AI agent deployments, regularly audit persistent AI memory distinct from standard software updates, and diligently manage LLM provider credentials in the aftermath of any security exposure.
