RufRoot flaw exposed Ruflo deployments to command execution and AI memory poisoning

On July 29, 2026, Noma Labs detailed RufRoot, a critical flaw in the Ruflo multi-agent platform. Tracked as CVE-2026-59726 with a CVSS score of 10.0, it enables unauthenticated remote code execution in every release before version 3.16.3.

Why the default deployment created systemic risk

Ruflo, originally launched as Claude Flow, orchestrates agent swarms and autonomous workflows for Claude Code and OpenAI Codex. The open-source project has more than 66,500 GitHub stars, giving the vulnerable default configuration a potentially broad impact.

Its Docker Compose file bound port 3001 to 0.0.0.0, exposing an unauthenticated Model Context Protocol bridge on every network interface. Actual reachability depended on firewalls, security groups and segmentation, but any reachable instance was exploitable without credentials.

From one request to persistent AI compromise

The bridge exposed 233 tools covering shell execution, databases, agents and memory. A single HTTP POST to the MCP endpoint could invoke terminal_execute and open a shell in the container. Attackers could then steal LLM provider keys, read conversations, launch swarms using the victim’s account and deploy a persistent backdoor under /app.

“The MCP bridge shipping in ruflo/docker-compose.yml exposed POST /mcp with no authentication. The docker-compose defaults bound the bridge and MongoDB to all interfaces.”

The same access allowed attackers to inject malicious patterns into AgentDB. This memory poisoning could steer future AI responses after the initial intrusion had ended, turning a container breach into a persistent integrity failure.

After responsible disclosure on June 30, maintainer Reuven Cohen shipped a fix within 24 hours. Version 3.16.3 binds the MCP bridge to loopback by default, places terminal_execute behind server-side executeTool controls and enables MongoDB authentication.

Exposed operators should close ports 3001 and 27017, rotate every LLM API key, rebuild containers from clean images, inspect MongoDB and audit AgentDB for injected pattern-store entries. For businesses, the key lesson is that patching an AI platform is insufficient when credentials, stored conversations and persistent model memory may already be compromised.