Ruflo MCP Flaw Allows Unauthenticated Code Execution
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Ruflo exposed its Model Context Protocol (MCP) bridge on port 3001 by default in versions before 3.16.3, enabling unauthenticated remote code execution via HTTP POST requests to the /mcp endpoint
- Ruflo's default docker-compose.yml configuration bound the MCP bridge and MongoDB instance to all network interfaces (0.0.0.0), allowing full system compromise without authentication on exposed deployments
- Noma Labs identified and reported the vulnerability—dubbed RufRoot and tracked as CVE-2026-59726 with a CVSS score of 10.0—on June 30, 2026, leading to a patch within 24 hours from project maintainer Reuven Cohen
- Reuven Cohen released a fix that reconfigures the MCP bridge to bind only to the loopback interface, disables unauthenticated terminal execution, and enables MongoDB authentication to prevent data theft and memory tampering
- Noma Labs warned that attackers could poison Ruflo’s AgentDB learning store, allowing persistent manipulation of AI behavior and responses long after initial access was closed
- Operators of Ruflo instances are advised to immediately rotate LLM API keys, audit AgentDB for malicious patterns, close ports 3001 and 27017, and rebuild containers from clean images due to risk of backdoor persistence
Why it matters: Organizations using Ruflo in exposed environments face material compromise of AI credentials and conversational data, with attackers able to alter AI memory patterns that influence future outputs—making remediation more complex than a simple patch and requiring full credential and memory audits.
