CVE-2026-59726 (RufRoot): Unauthenticated RCE in Ruflo MCP Bridge Poisons AI Agent Memory

Key facts for RufRoot Ruflo MCP bridge

Detection coverage for RufRoot Ruflo MCP bridge

As of 2026-08-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1762 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Post-Exploitation Discovery, Credential Harvesting, and require() Backdoor Persistence (RufRoot)

Detects a Node/Express child process (the Ruflo MCP bridge's terminal_execute handler) spawning shell discovery commands (id, hostname, printenv, env, whoami) consistent with post-exploitation reconnaissance and LLM-provider API-key theft following CVE-2026-59726 (RufRoot) unauthenticated RCE, correlated with a require('./beacon.js')-style persistence write to the application's beacon.js/index.js entrypoint on the same host.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1082, T1033, T1552, T1528, T1554, T1053, T1070.003
• Data sources: sysmon, edr_process_creation, linux_auditd, file_integrity_monitoring
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon OR index=edr sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational","linux:auditd","osquery:process_events")
| eval is_node_parent=if(match(ParentImage, "(?i)node"), 1, 0)
| eval is_discovery_cmd=if(match(CommandLine, "(?i)(^|\s)(id|hostname|printenv|env|whoami)(\s|$)"), 1, 0)
| where is_node_parent=1 AND is_discovery_cmd=1
| eval is_credential_harvest=if(match(CommandLine, "(?i)(printenv|env)\b.*(API_KEY|ANTHROPIC|OPENAI|GOOGLE|OPENROUTER)"), 1, 0)
| stats count as event_count, values(CommandLine) as commands_observed, min(_time) as first_seen, max(_time) as last_seen by host, user, Image, ParentImage
| join type=left host
    [ search index=sysmon OR index=edr sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational","linux:fim")
      | where match(TargetFilename, "(?i)(beacon\.js|index\.js)$")
      | stats count as persistence_file_events, values(TargetFilename) as files_touched by host ]
| where event_count > 0
| sort -event_count

Microsoft KQL

let Lookback = 24h;
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessParentFileName has "node" or InitiatingProcessFileName has "node"
| where ProcessCommandLine matches regex @"(?i)(^|\s)(id|hostname|printenv|env|whoami)(\s|$)"
| extend IsCredentialHarvest = ProcessCommandLine matches regex @"(?i)(printenv|env).*(API_KEY|ANTHROPIC|OPENAI|GOOGLE|OPENROUTER)"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessParentFileName, IsCredentialHarvest
| join kind=leftouter (
    DeviceFileEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ ("beacon.js", "index.js")
    | project DeviceName, FileEventTimestamp = Timestamp, PersistenceFileName = FileName, ActionType
) on DeviceName
| summarize EventCount = count(), Commands = make_set(ProcessCommandLine, 10), PersistenceFiles = make_set(PersistenceFileName, 5) by DeviceName, AccountName
| where EventCount > 0
| order by EventCount desc

Sigma

title: Post-Exploitation Discovery, Credential Harvesting, and Persistence via Ruflo MCP Bridge (RufRoot)
id: 7f1a2b3c-59a1-4d61-9b2c-tl17620002
status: experimental
description: Detects a Node/Express child process (the Ruflo MCP bridge's terminal_execute handler) spawning shell discovery commands (id, hostname, printenv, env, whoami) consistent with post-exploitation credential harvesting following CVE-2026-59726 (RufRoot) unauthenticated RCE, optionally followed by a require('./beacon.js') persistence write to the application entrypoint.
references:
    - https://noma.security/blog/rufroot-the-mcp-bridge-vulnerability-that-turns-agents-into-rogue-admins-cve-2026-59726/
    - https://github.com/ruvnet/ruflo/security/advisories/GHSA-c4hm-4h84-2cf3
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-29
tags:
    - attack.discovery
    - attack.t1082
    - attack.t1033
    - attack.credential-access
    - attack.t1552
    - attack.t1528
    - attack.persistence
    - attack.t1554
    - attack.t1053
    - attack.defense-evasion
    - attack.t1070.003
    - cve.2026.59726
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith: '/node'
    selection_cmd:
        CommandLine|contains:
            - 'id && hostname'
            - 'printenv'
            - 'env'
            - 'whoami'
    condition: selection_parent and selection_cmd
falsepositives:
    - Legitimate node-based health-check or container-startup scripts calling printenv/id/whoami directly at boot
level: high

Known false positives:

• Legitimate node-based health-check or container-entrypoint scripts calling id/hostname/printenv/whoami directly at boot
• Developer tooling that intentionally writes a same-named beacon.js module as part of legitimate build tooling (rare in production containers)

Tuning notes: Baseline expected parent-child process trees for the Ruflo container image; exclude the container's own documented startup script paths/hashes, and alert only on printenv/env output containing known LLM-provider key prefixes (sk-, sk-ant-, sk-or-) to reduce noise from benign env enumeration.

• 🔒 Unauthenticated [indicator] MCP Bridge Tool Invocation (RufRoot Exploitation) · unlock with TL Creds
• 🔒 Post-Exploitation Discovery, Credential Harvesting, and require() Backdoor Persistence (RufRoot) · unlock with TL Creds
• 🔒 AgentDB Poisoning, Agent-Swarm Weaponization, and Unauthenticated MongoDB C2/Exfil (RufRoot) · unlock with TL Creds
• 🔒 Unauthenticated [indicator] MCP Bridge Tool Invocation (RufRoot Exploitation) · unlock with TL Creds
• 🔒 Post-Exploitation Discovery, Credential Harvesting, and require() Backdoor Persistence (RufRoot) · unlock with TL Creds
• 🔒 AgentDB Poisoning, Agent-Swarm Weaponization, and Unauthenticated MongoDB C2/Exfil (RufRoot) · unlock with TL Creds
• 🔒 Unauthenticated [indicator] MCP Bridge Tool Invocation (RufRoot Exploitation) · unlock with TL Creds
• 🔒 AgentDB Poisoning, Agent-Swarm Weaponization, and Unauthenticated MongoDB C2/Exfil (RufRoot) · unlock with TL Creds

Indicators of compromise for RufRoot Ruflo MCP bridge

As of 2026-08-02, Threadlinqs Intelligence tracks 33 indicators of compromise for TL-2026-1762.

Sample indicators (2 of 33)

• File hash: d00a0a40cd8bdbca877ac7f675f416bdc69accd1
• File hash: 4eb807aa7cfc184724e2e745611980f744e0600e

Defanged, TLP:CLEAR. Full set of 33 indicators: unlock with TL Creds.

How RufRoot Ruflo MCP bridge works

Patched in v3.16.3, shipped within 24 hours of responsible disclosure by Noma Labs (Noma Security).

Ruflo is a Rust/WASM-rewritten, multi-provider successor to "Claude Flow," an agent meta-harness for Claude Code and Codex that orchestrates swarms of AI agents via a built-in Model Context Protocol (MCP) bridge. That bridge is an Express.js server exposing 233 tools — including shell execution, database operations, swarm control, and persistent memory storage — over a JSON-RPC HTTP API at POST /mcp and POST /mcp/:group. Prior to v3.16.3, the project's default docker-compose.yml bound this endpoint, and the backing MongoDB instance on port 27017, to all network interfaces (0.0.0.0) with zero authentication middleware. A command blocklist (AUTOPILOT_BLOCKED_PATTERNS) existed but was only enforced inside the higher-level 'autopilot' orchestration flow, never at the /mcp bridge layer itself, so any network-reachable deployment was fully exploitable with a single unauthenticated HTTP POST.

The disclosed exploit chain (CVE-2026-59726, dubbed 'RufRoot' by Noma Labs researcher Eli Ainhorn) begins with an unauthenticated tools/list call enumerating all 233 exposed tools, followed by a tools/call invocation of ruflo__terminal_execute to obtain shell access as the container's node user (uid 1000) — demonstrated in the public PoC with `curl -s -X POST https://<target>:3001/mcp -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"ruflo__terminal_execute","arguments":{"command":"id && hostname"}}}'`. From that shell, a `printenv` extracts LLM provider API keys (OpenAI, Anthropic, Google, OpenRouter) inherited via process.env, which can then be used to spawn attacker-controlled agent swarms (ruflo__swarm_init, ruflo__agent_spawn) on the victim's own compute and billing. Because MongoDB on the internal Docker network also lacked authentication, attackers could install a client and dump all stored conversations and metadata. The writable /app directory further enabled persistence: a beacon.js backdoor phoning home stolen keys on a schedule, wired into the startup path via a require('./beacon.js') injection into index.js so that killing PID 1 and letting Docker's restart policy relaunch the container guarantees re-execution. Shell history deletion was used to reduce forensic trace. Noma Labs documents the full compromise as an eight-step chain: tool enumeration, arbitrary command execution, environment-variable credential theft, agent-swarm weaponization, AgentDB pattern poisoning, MongoDB conversation theft, backdoor persistence, and forensic cleanup.

The most novel impact is AgentDB learning-store poisoning: the ruflo__agentdb_pattern-store tool lets an attacker inject fabricated 'learned' patterns — for example forged SOC2-compliance policy text instructing agents to embed attacker-controlled URLs in generated deployment scripts — into the shared pattern pipeline that steers future agent outputs for every user of that instance, without any obvious signal that the memory has been tampered with.

Product history is directly relevant to blast radius: the project launched in June 2025 as "Claude Flow" and was rebranded to Ruflo on 2026-02-27 alongside the v3.5 stable release, which included a Rust/WASM rewrite of core orchestration internals — meaning every self-hosted Claude Flow/Ruflo deployment across roughly 13 months of releases prior to v3.16.3 inherited the same insecure-by-default docker-compose binding.

Ruflo maintainer Reuven Cohen shipped v3.16.3 at 2026-07-01T14:34:00Z, within 24 hours of disclosure, via PR #2521 (ADR-166: MCP Bridge Unauthenticated RCE Remediation, fix commit d00a0a40cd8bdbca877ac7f675f416bdc69accd1), changing the MCP bridge to bind to loopback by default (fails closed with a startup exit code 1 if MCP_BIND_HOST=0.0.0.0 is set without a matching MCP_AUTH_TOKEN), adding constant-time-comparison bearer-token authentication, gating terminal_execute behind an opt-in MCP_ENABLE_TERMINAL flag, requiring MongoDB authentication (MONGO_INITDB_ROOT_PASSWORD / --auth), running the bridge container read-only with tmpfs, replacing wildcard CORS with an allowlist, and adding 12/12 CI static-and-runtime regression tests that verify loopback binding, authentication middleware presence, terminal gating, and compose defaults on every future PR touching security-relevant files (deferred follow-up items include per-backend environment allowlists and chat-UI token transport). Because a patched redeploy does not undo prior AgentDB poisoning or credential theft, Noma Labs and the vendor both stress that operators of previously exposed instances must treat exposure as a full compromise: rotate all LLM API keys, audit AgentDB and MongoDB for tampering, and rebuild from clean images rather than patch in place.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021 Remote Services

Exfiltration

T1029 Scheduled Transfer; T1041 Exfiltration Over C2 Channel

Discovery

T1033 System Owner/User Discovery; T1046 Network Service Discovery; T1082 System Information Discovery; T1518 Software Discovery

Execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell; T1106 Native API; T1609 Container Administration Command

Defense Evasion

T1070 Indicator Removal; T1070.003 Indicator Removal: Clear Command History

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

stealth

T1078.004 Valid Accounts: Cloud Accounts

Initial Access

T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories

Impact

T1496 Resource Hijacking; T1565.001 Data Manipulation: Stored Data Manipulation

Persistence

T1505 Server Software Component; T1554 Compromise Host Software Binary

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

Reconnaissance

T1592 Gather Victim Host Information; T1595.002 Active Scanning: Vulnerability Scanning

Remediation for RufRoot Ruflo MCP bridge

Patches

• Upgrade to ruflo v3.16.3 (fixes GHSA-c4hm-4h84-2cf3 / CVE-2026-59726, PR #2521, commit d00a0a40cd8bdbca877ac7f675f416bdc69accd1)

Immediate actions

• Immediately firewall/close ports 3001 (MCP bridge) and 27017 (MongoDB) from any untrusted network access
• Rotate all LLM provider API keys (OpenAI, Anthropic, Google, OpenRouter) present in the container environment — treat as compromised
• Audit the AgentDB pattern/learning store for injected or anomalous patterns; a patch alone does not undo prior poisoning
• Inspect MongoDB conversation/message collections for unauthorized access or tampering
• Rebuild affected containers from clean, patched images rather than patching in place

Workarounds

• If immediate upgrade is not possible, firewall ports 3001 and 27017 from all untrusted networks and restrict MCP bridge access to localhost or a trusted VPN only

Longer-term hardening

• Upgrade Ruflo to v3.16.3 or later
• Never bind the MCP bridge or database ports to 0.0.0.0 in production; enforce loopback-only binding with explicit opt-in for public exposure
• Require MCP_AUTH_TOKEN bearer authentication for any network-exposed MCP endpoint
• Disable terminal_execute and other high-privilege MCP tools unless explicitly required (MCP_ENABLE_TERMINAL=false by default)
• Enforce MongoDB authentication (MONGO_INITDB_ROOT_PASSWORD) and network segmentation for backing datastores
• Run MCP bridge containers read-only with tmpfs, and replace wildcard CORS with an explicit allowlist
• Add CI regression tests (loopback binding, auth middleware, terminal gating, compose defaults) to prevent insecure network-binding defaults from re-entering docker-compose configurations

Affected and fixed versions

• ruvnet (maintainer: Reuven Cohen) — Ruflo (formerly Claude Flow)
  Vulnerable versions: < 3.16.3
  Fixed in: 3.16.3

Timeline of RufRoot Ruflo MCP bridge

Last updated 2026-08-02 · 2 updates · revalidated 2× · latest source

• 2025-06-01 The project originally launches as "Claude Flow," an AI agent meta-harness orchestrating swarms of agents for Claude Code and Codex.
• 2026-02-27 Claude Flow is rebranded to locked-ioc-32 alongside the v3.5 stable release, which included a Rust/WASM rewrite of core orchestration internals — the same release lineage that carried forward the insecure-by-default docker-compose MCP bridge binding later disclosed as CVE-2026-59726.
• 2026-06-30 PR #2521 is opened; commit locked-ioc-29 flips the MCP Bridge's default network bind from public (0.0.0.0) to loopback-only (127.0.0.1) with an explicit opt-in for public deployment.
• 2026-06-30 locked-ioc-19's internal investigation documents confirmed findings V1-V8 with file:line evidence and the 8-step attack chain (commit locked-ioc-28), proposing the ADR-166 remediation.
• 2026-06-30 PR #2521 ("ADR-166: MCP Bridge Unauthenticated RCE Remediation") is opened on the same day as disclosure to begin the fix.
• 2026-06-30 Noma Labs responsibly discloses CVE-2026-59726 (RufRoot) to locked-ioc-32 maintainer locked-ioc-20.
• 2026-07-01 GitHub Security Advisory GHSA-c4hm-4h84-2cf3 is published by locked-ioc-31, crediting discoverer locked-ioc-22 (locked-ioc-19) with review credit to locked-ioc-14, and assigning CVSS 3.1 base score 10.0.
• 2026-07-01 locked-ioc-32 v3.16.3 is released at 14:34 UTC — PR #2521 merged (fix commit locked-ioc-3) — implementing ADR-166: loopback-only MCP bridge binding, bearer-token authentication, gated terminal_execute, mandatory MongoDB authentication, a read-only bridge container with tmpfs, and 12/12 new CI regression tests, within 24 hours of disclosure.
• 2026-07-09 CVE-2026-59726 is published in the National Vulnerability Database.
• 2026-07-10 NVD record for CVE-2026-59726 is last modified; NVD notes it is not prioritized for further enrichment due to resource constraints.
• 2026-07-29 Noma Labs independently re-tests and confirms that the v3.16.3 patch closes the unauthenticated RCE path, prior to proceeding with public disclosure.
• 2026-07-29 The Hacker News, CyberPress, and GBHackers publish coverage of the vulnerability, making the PoC curl command and exploit chain broadly public.
• 2026-07-29 locked-ioc-19 publishes the full 'RufRoot' technical writeup detailing the end-to-end eight-step exploit chain (tool enumeration, RCE, credential theft, agent-swarm weaponization, AgentDB pattern poisoning, MongoDB conversation theft, backdoor persistence, forensic cleanup).
• 2026-08-01 As of this assessment, CVE-2026-59726 carries an EPSS score under 1%, is not listed in the CISA Known Exploited Vulnerabilities catalog per OpenCVE/CVE.org tracking, and no public reporting identifies confirmed in-the-wild exploitation.

Update history

• 2026-08-02 — CVE-2026-59726 ("RufRoot"): Critical Unauthenticated RCE in locked-ioc-32 MCP Bridge Exposes 233 AI Agent Tools (CVSS 10.0): What changed No change to severity (CRITICAL), exploitability (POC_PUBLIC), status (ACTIVE), CVSS (10.0), or attribution (Unknown/LOW) — this report restates the same CVE-2026-59726 / RufRoot incident already on file. New indicators (2) Ind
• 2026-08-02 — RufRoot (CVE-2026-59726): Unauthenticated MCP Bridge RCE in locked-ioc-32 AI Agent Platform Enables Rogue Agent Swarms and Persistent Memory Poisoning: What changed No field-level escalation. Severity remains CRITICAL, exploitability remains POC_PUBLIC, CVSS remains 10.0/10.0. The newer report actually adds risk-context evidence pointing the other direction (EPSS <1%, not in CISA KEV, no c

Sources cited for RufRoot Ruflo MCP bridge

• GHSA-c4hm-4h84-2cf3: Unauthenticated RCE in ruflo MCP bridge default docker-compose deployment GitHub · Advisory · 2026-07-01
• NVD - CVE-2026-59726 NVD (NIST) · Advisory · 2026-07-09
• RufRoot: The MCP Bridge Vulnerability That Turns Agents Into Rogue Admins (CVE-2026-59726) noma.security · Research · 2026-07-29
• CVE-2026-59726 | THREATINT cve.threatint.eu · Research
• Ruflo v3.16.3 — Security release (GHSA-c4hm-4h84-2cf3, ADR-166 MCP bridge RCE remediation) GitHub · Code repository · 2026-07-01
• PR #2521 — ADR-166: MCP Bridge Unauthenticated RCE Remediation GitHub · Code repository · 2026-07-01
• Fix commit d00a0a40 — ADR-166 remediation implementation GitHub · Code repository · 2026-07-01
• Claude Flow Is Dead. Long Live Ruflo. dev.to · Blog · 2026-04-26
• Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory The Hacker News · News · 2026-07-29
• Critical Ruflo Flaw Lets Hackers Steal API Keys and Control Autonomous Agents cyberpress.org · News · 2026-07-29
• Critical Ruflo MCP Bridge Flaw Allows Full AI Agent Platform Takeover gbhackers.com · News · 2026-07-29

Threats related to RufRoot Ruflo MCP bridge

• CVE-2026-20316: Cisco Secure Firewall Management Center Hard-coded Password Vulnerability Added to CISA KEV
• CVE-2026-57309: Unauthenticated Blind SQL Injection in Windu CMS 4.1 (with CVE-2026-57310 Weak Password Hashing and CVE-2026-57311 Unrestricted File Upload)

Related coverage of this activity

• Operation Lunar Peek Sliver C2