Ruflo AI Orchestration Platform Exposes Critical CVE-2026-59726 Flaw
A critical vulnerability (CVE‑2026‑59726) in Ruflo’s Model Context Protocol (MCP) Bridge has been disclosed, receiving a CVSS base score of 10.0. The flaw allows unauthenticated attackers to send a single crafted HTTP POST request to the /mcp endpoint, gaining arbitrary shell execution inside the container and direct access to 233 exposed tools, including the terminal execution tool.
The issue affects all Ruflo versions prior to 3.16.3 when deployed with the default docker‑compose.yml that binds the MCP Bridge to 0.0.0.0 on ports 3001 and 27017. Exploitation can exfiltrate environment variables containing API keys for major LLM providers such as OpenAI, Anthropic and Google Gemini, hijack AI agent swarms, and inject malicious data into Ruflo’s persistent AgentDB memory store. Patching to version 3.16.3 stops further access but does not erase previously poisoned memory. Mitigation includes upgrading Ruflo, restricting the bridge to localhost, enabling token‑based authentication, rotating AI provider credentials and blocking the vulnerable ports.
Entities: CVE-2026-59726 · Model Context Protocol (MCP) Bridge · Model Context Protocol Bridge · Noma Labs · OpenAI · Ram Varadarajan · Ruflo
Claims
What the coverage asserts, and how well corroborated each claim is across sources.
- [● 3 SOURCES] Attackers can read environment variables to steal API keys for OpenAI, Anthropic and Google Gemini. (Noma Security research)
- [● 3 SOURCES] Mitigation steps include updating Ruflo, binding the bridge to localhost, enabling token authentication, rotating API keys and blocking ports 3001 and 27017. (Noma Security research)
- [● 3 SOURCES] All Ruflo versions before 3.16.3 deployed with the default docker‑compose.yml are vulnerable. (Noma Security research)
- [● 3 SOURCES] Attackers can modify AgentDB, injecting malicious instructions that persist after the software is patched. (Noma Security research)
- [● 3 SOURCES] Updating to Ruflo version 3.16.3 closes the entry point but does not remove previously injected memory. (Noma Security research)
- [● 3 SOURCES] CVE‑2026‑59726 has a CVSS base score of 10.0. (Noma Security research)
- [● 3 SOURCES] The MCP Bridge exposes 233 tools, including a terminal execution tool that provides shell access. (Noma Security research)
- [● 3 SOURCES] The vulnerability allows unauthenticated attackers to execute arbitrary commands via the MCP Bridge. (Noma Security research)