Critical Vulnerability in Ruflo AI Orchestration Platform Allows Unauthenticated Remote Code Execution

Critical Flaw in Ruflo AI Platform

Security researchers at Noma Labs have identified a critical-severity vulnerability, tracked as CVE-2026-59726 with a CVSS score of 10/10, in Ruflo, an open-source AI agent orchestration platform. This flaw allows unauthenticated attackers to execute arbitrary commands inside the container where Ruflo is deployed.

Vulnerability Details

The vulnerability, named "RufRoot" by Noma Labs, resides in the MCP bridge within the ruflo/docker-compose.yml configuration. Specifically, the POST /mcp endpoint was exposed without requiring authentication. In default docker-compose deployments, the bridge and MongoDB are bound to all interfaces, making instances reachable over the network susceptible to exploitation.

Attackers can invoke the `terminal_execute` command to run commands within the bridge container, gaining shell access as the node user. This provides access to sensitive system resources and data.

Potential Impact of Exploitation

Successful exploitation of CVE-2026-59726 could lead to severe consequences. Attackers could obtain provider API keys, spawn agent swarms using the victim's credentials, and inject malicious patterns into the AgentDB learning store. Tampering with the learning store could corrupt AI outputs for all users, undermining the integrity and reliability of the AI applications.

About Ruflo

Ruflo, formerly known as Claude Flow, is a popular automation assistant with over 67,000 GitHub stars. It provides a multi-model AI chat interface, agent swarms for coordinating up to 100 agents, persistent memory for recalling past interactions, and a built-in Model Context Protocol (MCP) server for executing tasks. The MCP bridge is described as Ruflo's "central nervous system," through which all agent actions and memory operations flow, making its unauthenticated exposure particularly critical.