A critical vulnerability in Ruflo (formerly Claude Flow), the leading open-source AI agent orchestration platform, allows unauthenticated remote code execution via its exposed Model Context Protocol (MCP) bridge. Tracked as CVE-2026-59726 with a maximum CVSS 10.0 score, the flaw affects all versions prior to 3.16.3 and was actively exploitable in default Docker deployments.

Vulnerability Details

CVE-2026-59726 (CVSS 10.0 Critical) — GHSA-c4hm-4h84-2cf3

Attribute	Value
CVE ID	CVE-2026-59726
CVSS 3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity	Critical (10.0)
Affected Versions	Ruflo < 3.16.3
Fixed Version	3.16.3 (released July 29, 2026)
Attack Vector	Network (port 3001)
Authentication	None required
User Interaction	None required
CWE	CWE-78 (OS Command Injection), CWE-306 (Missing Authentication), CWE-942 (Permissive CORS)

The vulnerability stems from Ruflo's default docker-compose.yml binding the MCP Bridge Express.js server to 0.0.0.0:3001 without authentication. The bridge exposes 233 tools over the MCP JSON-RPC protocol, including ruflo__terminal_execute which runs arbitrary shell commands inside the container.

A single unauthenticated HTTP POST request achieves remote code execution:

The command blocklist (AUTOPILOT_BLOCKED_PATTERNS) applies only to the autopilot flow and is completely bypassed by the /mcp endpoint.

Impact Assessment

Noma Labs demonstrated an 8-step attack chain that escalates from initial RCE to persistent compromise:

1. Reconnaissance — tools/list enumerates all 233 tools without authentication
2. Remote Code Execution — terminal_execute runs arbitrary commands (validated via OAST callback)
3. API Key Theft — printenv dumps all LLM provider keys (OpenAI, Anthropic, Google, OpenRouter) passed via process.env
4. Agent Weaponization — Attacker spawns rogue agent swarms using victim's own keys via ruflo__swarm_init and ruflo__agent_spawn
5. AI Memory Poisoning — Malicious patterns injected into AgentDB via ruflo__agentdb_pattern-store persist across sessions (e.g., fake compliance policies inserting attacker URLs into generated deployment scripts)
6. Conversation Theft — Unauthenticated MongoDB on internal Docker network dumped via mongodump exfiltrating all messages, titles, and metadata
7. Persistent Backdoor — Beacon script written to /app/beacon.js, injected into index.js, survives container restarts via Docker's restart: unless-stopped policy
8. Cleanup — Shell history cleared, no forensic trace

The MCP Bridge is Ruflo's central nervous system. Every tool call, agent action, and memory operation flows through it. Unauthenticated access means total platform compromise.

Affected Systems

Any self-hosted Ruflo deployment using the default Docker Compose configuration is vulnerable. This includes:

• Developers running docker compose up -d from the official repository
• Organizations deploying Ruflo on AWS EC2, GCP Compute Engine, Azure VMs, or on-premises Kubernetes (without additional network policies)
• Teams using Ruflo for agent swarm orchestration, persistent memory, or MCP tool integration

Not affected: GitHub Codespaces, Gitpod, or other environments where port 3001 is not externally reachable. However, any network-reachable instance is fully exploitable.

Mitigation & Patching

Immediate Actions (Priority Order)

1. Update to Ruflo 3.16.3 or later

   bash

2. Close firewall ports 3001 and 27017 immediately if update cannot be applied instantly

3. Rotate all LLM provider API keys (OpenAI, Anthropic, Google, OpenRouter, etc.) — assume all keys in compromised deployments are stolen

4. Audit AgentDB pattern store for injected entries — a patched redeploy alone does NOT undo memory poisoning

5. Audit MongoDB for tampering or unauthorized collections

What 3.16.3 Fixed (PR #2521, ADR-166)

Fix	Description
MCP bridge binds to loopback by default	Fails closed if you attempt public bind without MCP_AUTH_TOKEN
Bearer auth middleware	Constant-time token comparison on /mcp endpoint
terminal_execute gated	Requires MCP_ENABLE_TERMINAL=true (off by default)
MongoDB authentication	Required on boot
Container hardening	Read-only root filesystem with tmpfs
CORS allowlist	Replaces wildcard origin
CI regression tests	Prevents insecure defaults from returning

Detection

Check for compromise indicators:

IOCs:

• Unauthenticated POST requests to /mcp from external IPs
• tools/call with ruflo__terminal_execute in payload
• OAST callbacks from container (Burp Collaborator, interactsh)
• Unexpected MongoDB connections on port 27017

Frequently Asked Questions

Is this a vulnerability in Claude Code or Codex?

No. Ruflo is an independent orchestration platform that integrates with Claude Code and Codex. The vulnerability is in Ruflo's MCP Bridge, not in the coding agents themselves.

Does updating to 3.16.3 remove a backdoor already planted?

No. Updating closes the entry point but does not remove:

• Injected AgentDB patterns (memory poisoning)
• Backdoor scripts written to /app/
• Stolen API keys already exfiltrated
• MongoDB modifications

You must audit and clean compromised deployments before trusting them.

Can I just disable the terminal tool instead of updating?

Setting MCP_ENABLE_TERMINAL=false (new in 3.16.3) mitigates RCE but leaves 232 other tools exposed unauthenticated, including agent spawning, memory manipulation, and database access. Full update is required.

How do I know if my deployment was exposed?

If your docker-compose.yml binds port 3001 to 0.0.0.0 (the default) and your firewall/security group allows inbound traffic to that port, you were exposed. Check cloud provider security groups, AWS Security Groups, GCP Firewall Rules, Azure NSGs.

Is there a SaaS/hosted version that was affected?

Ruflo is self-hosted only. There is no vendor-managed SaaS offering. Each deployment is the operator's responsibility.

Key Takeaways

• CVE-2026-59726 is a CVSS 10.0 unauthenticated RCE in Ruflo's MCP Bridge affecting all versions before 3.16.3
• Default Docker Compose exposes port 3001 on all interfaces with zero authentication
• 233 tools exposed, including arbitrary shell execution, agent management, and memory manipulation
• Attack chain enables API key theft, agent weaponization, AI memory poisoning, conversation exfiltration, and persistent backdoors
• Patch immediately to 3.16.3, rotate all API keys, audit AgentDB and MongoDB
• Treat any MCP server as critical infrastructure: authenticate every request, restrict default tools, never expose to untrusted networks

---

Sources: Noma Labs RufRoot Report, GitHub Security Advisory GHSA-c4hm-4h84-2cf3, NVD CVE-2026-59726, Ruflo v3.16.3 Release