Press play to start listening
A vulnerable Ruflo deployment could be reached without authentication, and a single network request was enough to execute commands inside the MCP bridge container, according to research published by Noma Security.
The flaw, named RufRoot and tracked as CVE-2026-59726, received the maximum CVSS score of 10.0. It affects Ruflo versions before 3.16.3 when deployed using the project’s previous default Docker Compose configuration.
Ruflo, formerly known as Claude Flow, is an open-source platform that coordinates AI agents, gives them access to tools, and maintains information between sessions. It works as a supporting layer for coding agents such as Claude Code and Codex. The vulnerability is in Ruflo, not in Claude Code or Codex themselves.
No Login Required to Access Agent Tools
The previous default configuration exposed Ruflo’s Model Context Protocol (MCP) bridge to the network without authentication. MCP allows AI systems to call external tools, including tools that interact with files, databases, and operating-system commands.
Noma Labs found that an attacker could send a request to the exposed bridge and invoke Ruflo’s terminal_execute tool. This provided command execution inside the bridge container and access to the 233 tools exposed through the MCP bridge.
From there, the attacker could read API keys used to connect with AI providers and access conversations stored by the affected deployment. Stolen provider keys could also be used outside Ruflo, leaving the account owner responsible for unauthorized AI usage and related charges.
The same access allowed researchers to modify AgentDB, Ruflo’s persistent learning and memory store. Malicious instructions placed there could later be retrieved by agents and influence how they respond to tasks from other users.
Patching Does Not Remove Poisoned Memory
According to researchers, memory tampering changes the recovery process because updating Ruflo closes the original entry point but does not remove instructions already written into AgentDB. An organization could therefore be running patched software while its agents continue using altered information from an earlier compromise.
Ram Varadarajan, CEO of cyber deception company Acalvio, said software updates stop further access but do not reverse changes already made to persistent agent memory. He argued that organizations must verify the integrity of an AI system’s stored knowledge before trusting its behaviour after an incident.
This does not mean every vulnerable deployment was compromised. No evidence of active exploitation has been reported. However, administrators who exposed the affected MCP bridge should not treat an upgrade alone as proof that their installation is clean.
Ruflo Fixed the Default Configuration
Noma Labs disclosed the vulnerability to Ruflo’s maintainers on June 30, 2026, along with a working proof of concept tested against a live default deployment. The maintainers released a fix within 24 hours, and Noma independently confirmed that it blocked the reported attack.
Ruflo version 3.16.3 changed the default deployment to a locked configuration. Public access now requires explicit configuration and authentication. The official CVE record also confirms that versions before 3.16.3 are affected.
Anyone running an older version should update immediately, check whether the MCP bridge was reachable from outside trusted networks, and review logs for unexpected tool calls or shell commands.
Noma also recommends rotating AI provider keys, rebuilding affected containers from clean images, and examining AgentDB for unfamiliar instructions or altered learning patterns. The full RufRoot report provides technical details and remediation guidance.
