Full Report
Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex, that could result in unauthenticated remote code execution. The vulnerability, tracked as CVE-2026-59726 (CVSS score: 10.0), impacts all versions of the project before version 3.16.3. It has been codenamed RufRoot by Noma Security's
Analysis Summary
This vulnerability summary is based on the technical details provided in the research report concerning Ruflo.
# Vulnerability: RufRoot - Unauthenticated RCE in Ruflo AI Agent Harness
## CVE Details
- **CVE ID:** CVE-2026-59726
- **CVSS Score:** 10.0 (Critical)
- **CWE:** CWE-287 (Improper Authentication), CWE-306 (Missing Authentication for Critical Function)
## Affected Systems
- **Products:** Ruflo (Open-source AI agent multi-harness/orchestration platform)
- **Versions:** All versions prior to v3.16.3
- **Configurations:** Default deployments using `docker-compose.yml` where the MCP bridge and MongoDB were bound to all network interfaces (`0.0.0.0`).
## Vulnerability Description
The "RufRoot" vulnerability stems from an unauthenticated Model Context Protocol (MCP) bridge exposed to the network by default. The `docker-compose.yml` configuration bound port 3001 to all interfaces, allowing anyone with network access to interact with the platform's internal toolset. Because the platform lacked authentication on the `/mcp` and `/mcp/:group` endpoints, attackers could call sensitive functions—specifically execution tools—designed for the AI agents to interact with the host system.
## Exploitation
- **Status:** Publicly disclosed; Proof of Concept (PoC) logic described in research (e.g., calling `tools/call` via HTTP POST).
- **Complexity:** Low
- **Attack Vector:** Network (Unauthenticated)
## Impact
- **Confidentiality:** High. Attackers can siphon LLM API keys, harvest private user conversations, and access sensitive environment variables.
- **Integrity:** High. Attackers can "poison" the AI's memory (AgentDB), influencing future model responses and injecting malicious instructions.
- **Availability:** High. Attackers can execute arbitrary shell commands, potentially leading to total system takeover or persistent backdoors.
## Remediation
### Patches
- **Update to Ruflo v3.16.3 or later.** This version changes the default binding to the loopback interface (`127.0.0.1`), implements server-side `executeTool` controls, and enables MongoDB authentication.
### Workarounds
- **Network Filtering:** Immediately close/restrict access to ports `3001` (MCP Bridge) and `27017` (MongoDB) via firewall or security groups.
- **Manual Configuration:** Update `docker-compose.yml` to bind services only to `localhost` rather than `0.0.0.0`.
## Detection
- **Indicators of Compromise:**
- Unexpected HTTP POST requests to the `/mcp` endpoint originating from external/untrusted IPs.
- Presence of unknown entries in the `agentdb_pattern-store`.
- Unauthorized files created in the `/app` directory.
- **Monitoring:** Audit container logs for usage of the `ruflo__terminal_execute` tool by unidentified users.
## References
- **Vendor Advisory:** [https://github[.]com/ruvnet/ruflo/security/advisories/GHSA-c4hm-4h84-2cf3]
- **Release Notes:** [https://github[.]com/ruvnet/ruflo/releases/tag/v3.16.3]
- **Noma Security Research:** [https://noma[.]security/blog/rufroot-the-mcp-bridge-vulnerability-that-turns-agents-into-rogue-admins-cve-2026-59726/]
- **NVD Entry:** [https://nvd[.]nist[.]gov/vuln/detail/CVE-2026-59726]