Critical Ruflo Flaw Lets Attackers Hijack AI Systems via Unauthenticated RCE

Cybersecurity researchers at Noma Labs have disclosed a maximum-severity vulnerability in Ruflo, an open-source multi-agent orchestration harness for Anthropic Claude Code and OpenAI Codex, that exposes tens of thousands of AI deployments to unauthenticated remote code execution. Tracked as CVE-2026-59726 with a CVSS score of 10.0, the flaw—codenamed RufRoot—affects all Ruflo versions prior to 3.16.3 and stems from the project's default docker-compose.yml configuration, which binds the Model Context Protocol (MCP) bridge on port 3001 to 0.0.0.0 across all network interfaces. Ruflo (formerly Claude Flow) is widely adopted, with more than 66,500 stars on GitHub, meaning the blast radius for unpatched, internet-reachable instances is significant. Administrators can verify exposure on their own networks by running a port scanner against suspected hosts to confirm whether the MCP bridge is publicly reachable.

The vulnerability is straightforward to exploit because the MCP bridge exposes 233 tools—including shell command execution, database operations, and memory storage—without any authentication layer. A single unauthenticated HTTP POST request to the /mcp endpoint is enough to invoke terminal_execute and obtain a shell inside the bridge container, as demonstrated by security researcher Eli Ainhorn's one-liner: `curl -s -X POST https://:3001/mcp -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"ruflo__terminal_execute","arguments":{"command":"id && hostname"}}}'`. Once inside, attackers can exfiltrate API keys for LLM providers, harvest stored user conversations, weaponize autonomous agents, and poison the AgentDB learning-store to manipulate model responses—turning a single exposed service into full AI infrastructure compromise.

Beyond immediate command execution, the flaw enables persistent backdoor deployment by writing malicious payloads to the /app directory, meaning affected systems cannot be considered safe even after superficial remediation. Operators should rotate any credentials and API keys that may have resided on a vulnerable Ruflo instance and validate them against a password checker to ensure they meet current strength requirements. Noma Security disclosed the bug responsibly on June 30, 2026, and maintainer Reuven Cohen pushed a patch within 24 hours; version 3.16.3 now binds the MCP bridge to the loopback interface by default and gates terminal_execute behind authentication. Organizations running Ruflo should upgrade immediately, audit exposed instances using a privacy checkup, and place the service behind strict firewall rules and network segmentation to prevent the default 0.0.0.0 binding from re-emerging in future deployments.