RufRoot: the unauthenticated Ruflo MCP bridge that hands attackers a shell and an AI army

CVE-2026-59726 is a CVSS 10.0 vulnerability in Ruflo, an open-source AI agent orchestration platform with 67,000+ GitHub stars and approximately 10 million downloads. The flaw is in Ruflo's MCP Bridge, an Express.js server that exposes 233 tools over HTTP with zero authentication. A single unauthenticated HTTP POST request to port 3001 gives full command execution in the container. Noma Security's Noma Labs disclosed this on July 29, 2026, naming it RufRoot.

If you are running Ruflo in its default docker-compose configuration and it is reachable over a network, update to version 3.16.3 now. The patch changes the MCP bridge bind address from 0.0.0.0 to 127.0.0.1, adds authentication controls, gates terminal execution, and hardens MongoDB and container settings.

What an attacker can do with one unauthenticated request

The MCP bridge exposed 233 tools including shell command execution, database operations, agent management, and memory storage. With unauthenticated access to terminal_execute, an attacker can:

• Obtain a shell in the bridge container.
• Read all provider API keys stored in the environment: OpenAI, Anthropic, and any others configured.
• Access and poison the AgentDB learning store, corrupting future agent behavior by injecting malicious patterns into the learning pipeline.
• Spawn attacker-controlled agent swarms that operate under the legitimate platform's credentials.
• Plant persistent backdoors and clear shell history to remove traces.

The disclosure timeline was responsible: Noma Labs reported on June 30, 2026, the maintainer Reuven Cohen patched within 24 hours, and 3.16.3 shipped as a security release. Noma published the full analysis on July 29, giving organizations roughly a month from fix to public disclosure to patch.

Why this matters beyond Ruflo

Ruflo entered corporate environments as shadow AI. Organizations that deploy AI agent platforms from open-source projects frequently skip the authentication review they would apply to an internal API. The MCP bridge was a fully unauthenticated network service by default. That is not a subtle configuration error; it is a default that assumes the service will never be network-reachable. In practice, docker-compose deployments on shared infrastructure, cloud VMs, and developer workstations are regularly network-reachable.

Wiz Research published separate findings on July 29 showing that 5% of cloud environments already run at least one internet-facing MCP server, with Fortune 500 companies among those exposing employee PII and production write operations via unauthenticated endpoints. The Ruflo vulnerability and the Wiz exposure data land on the same day and point at the same structural problem: AI agent infrastructure is being deployed with the same casualness as early SaaS integrations, without the authentication baseline that comes with any conventional API.

What to do now

Update Ruflo to 3.16.3 if you have not already. Audit every AI agent platform in your environment for network-accessible management interfaces. Search your infrastructure for anything listening on port 3001 or any MCP bridge port. If you find unauthenticated MCP endpoints in production, treat them as critically exposed services. Apply authentication, restrict network access to localhost or a specific internal CIDR, and rotate any API keys that may have been accessible.

Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you have found exposed MCP infrastructure in your environment or want to talk through AI agent security posture.