Critical Ruflo MCP Flaw Allows Unauthenticated Remote Code Execution and AI Memory Poisoning

Cybersecurity researchers have disclosed a maximum-severity vulnerability in Ruflo, an open-source AI multi-agent orchestration platform, that could allow unauthenticated attackers to achieve remote code execution and poison AI memory. Tracked as CVE-2026-59726 with a CVSS score of 10.0, the flaw affects all versions prior to 3.16.3 and has been codenamed RufRoot by Noma Security’s Noma Labs.

Ruflo, originally launched as Claude Flow, is a meta-harness for Anthropic Claude Code and OpenAI Codex that enables users to deploy multi-player swarms, coordinate autonomous workflows, and build conversational AI systems. The vulnerability stems from the platform exposing 233 tools—including shell command execution, database operations, agent management, and memory storage—through an unauthenticated Model Context Protocol (MCP) bridge that is open to the network by default. The docker-compose.yml configuration file binds port 3001 to 0.0.0.0, making the bridge accessible on all network interfaces.

An attacker can exploit this by sending a single unauthenticated HTTP POST request to port 3001 to invoke the terminal_execute tool, gaining a shell in the bridge container. From there, they can steal LLM API keys, read user conversations, poison the AI’s memory to influence future model responses, and deploy persistent backdoors. The flaw also exposes MongoDB on port 27017 without authentication, enabling conversation theft.

Following responsible disclosure on June 30, 2026, the maintainer Reuven Cohen released a fix within 24 hours. The patch binds the MCP bridge to the loopback interface by default, gates terminal_execute behind server-side executeTool controls, and enables MongoDB authentication. Operators are urged to close ports 3001 and 27017, rotate all LLM API keys, audit the AgentDB pattern store for injected entries, and rebuild containers from clean images.