Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Ruflo (formerly Claude Flow), an open-source AI agent meta-harness for Anthropic Claude Code and OpenAI Codex with over 66,500 GitHub stars, contains a maximum-severity vulnerability (CVE-2026-59726, CVSS 10.0) in all versions before 3.16.3.
- The flaw, codenamed RufRoot by Noma Security's Noma Labs, stems from the project's default docker-compose.yml binding port 3001 to 0.0.0.0, exposing 233 tools including shell command execution through an unauthenticated Model Context Protocol bridge.
- A single unauthenticated HTTP POST to port 3001 granted attackers full remote code execution inside the bridge container, enabling theft of LLM API keys, harvesting of user conversations, and poisoning of the AgentDB learning-store to steer future AI outputs.
- Maintainer Reuven Cohen pushed a fix within 24 hours of responsible disclosure on June 30, 2026, binding the MCP bridge to the loopback interface by default, gating terminal_execute behind server-side controls, and enabling MongoDB authentication.
- Attackers exploiting the flaw spawned attacker-controlled agent swarms using stolen provider keys and wrote malicious payloads to the /app directory for persistent backdoor deployment, per the NIST NVD description.
- Operators running exposed instances are advised to immediately close firewall ports 3001 and 27017, rotate all LLM API keys, audit the AgentDB pattern store for injected entries, and rebuild containers from clean images.
Why it matters: Organizations running exposed Ruflo instances face LLM credential theft and a new attack class—persistent AI memory poisoning that corrupts every future model response on the platform. The 66,500-star project sits at the orchestration layer for Claude Code and Codex workflows, and exploitation weaponized the AI agent swarm itself against operators. Remediation extends far beyond patching to mandatory key rotation, full memory audits, and container rebuilds.
