started · updated
Ruflo AI Orchestration Platform Exposes Critical CVE-2026-59726 Flaw
A critical vulnerability (CVE‑2026‑59726) in Ruflo’s Model Context Protocol (MCP) Bridge has been disclosed, receiving a CVSS base score of 10.0. The flaw allows unauthenticated attackers to send a single crafted HTTP POST request to the /mcp endpoint, gaining arbitrary shell execution inside the container and direct access to 233 exposed tools, including the terminal execution tool.
The issue affects all Ruflo versions prior to 3.16.3 when deployed with the default docker‑compose.yml that binds the MCP Bridge to 0.0.0.0 on ports 3001 and 27017. Exploitation can exfiltrate environment variables containing API keys for major LLM providers such as OpenAI, Anthropic and Google Gemini, hijack AI agent swarms, and inject malicious data into Ruflo’s persistent AgentDB memory store. Patching to version 3.16.3 stops further access but does not erase previously poisoned memory. Mitigation includes upgrading Ruflo, restricting the bridge to localhost, enabling token‑based authentication, rotating AI provider credentials and blocking the vulnerable ports.
Entities
CVE-2026-59726 · Model Context Protocol (MCP) Bridge · Model Context Protocol Bridge · Noma Labs · OpenAI · Ram Varadarajan · Ruflo
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 3 SOURCES] Attackers can read environment variables to steal API keys for OpenAI, Anthropic and Google Gemini. www.blogspan.net · cybersecuritynews.com · hackread.com
- [● 3 SOURCES] Mitigation steps include updating Ruflo, binding the bridge to localhost, enabling token authentication, rotating API keys and blocking ports 3001 and 27017. www.blogspan.net · cybersecuritynews.com · hackread.com
- [● 3 SOURCES] All Ruflo versions before 3.16.3 deployed with the default docker‑compose.yml are vulnerable. www.blogspan.net · cybersecuritynews.com · hackread.com
- [● 3 SOURCES] Attackers can modify AgentDB, injecting malicious instructions that persist after the software is patched. www.blogspan.net · cybersecuritynews.com · hackread.com
- [● 3 SOURCES] Updating to Ruflo version 3.16.3 closes the entry point but does not remove previously injected memory. www.blogspan.net · cybersecuritynews.com · hackread.com
- [● 3 SOURCES] CVE‑2026‑59726 has a CVSS base score of 10.0. www.blogspan.net · cybersecuritynews.com · hackread.com
- [● 3 SOURCES] The MCP Bridge exposes 233 tools, including a terminal execution tool that provides shell access. www.blogspan.net · cybersecuritynews.com · hackread.com
- [● 3 SOURCES] The vulnerability allows unauthenticated attackers to execute arbitrary commands via the MCP Bridge. www.blogspan.net · cybersecuritynews.com · hackread.com