CVE-2026-59726 (RufRoot): Unauthenticated RCE in Ruflo MCP Bridge Poisons AI Agent Memory — Threadlinqs Intelligence
As of 2026-08-02, CVE-2026-59726 (RufRoot): Unauthenticated RCE in Ruflo MCP Bridge Poisons AI Agent Memory is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 33 indicators of compromise.
Threat ID: TL-2026-1762 · Severity: CRITICAL · CVSS: 10 · Status: ACTIVE · Category: VULNERABILITY
Updated: 2026-08-02 · 2 updates · revalidated 2× · latest source
Ruflo (formerly Claude Flow), an open-source AI multi-agent orchestration platform with 66,500+ GitHub stars, ships a docker-compose.yml that by default binds its MCP bridge (port 3001) and MongoDB
Ruflo is a Rust/WASM-rewritten, multi-provider successor to "Claude Flow," an agent meta-harness for Claude Code and Codex that orchestrates swarms of AI agents via a built-in Model Context Protocol (MCP) bridge. That bridge is an Express.js server exposing 233 tools — including shell execution, database operations, swarm control, and persistent memory storage — over a JSON-RPC HTTP API at POST /mcp and POST /mcp/:group. Prior to v3.16.3, the project's default docker-compose.yml bound this endpoint, and the backing MongoDB instance on port 27017, to all network interfaces (0.0.0.0) with zero authentication middleware. A command blocklist (AUTOPILOT_BLOCKED_PATTERNS) existed but was only enforced inside the higher-level 'autopilot' orchestration flow, never at the /mcp bridge layer itself, so any network-reachable deployment was fully exploitable with a single unauthenticated HTTP POST.
The disclosed exploit chain (CVE-2026-59726, dubbed 'RufRoot' by Noma Labs researcher Eli Ainhorn) begins with an unauthenticated tools/list call enumerating all 233 exposed tools, followed by a tools/call invocation of ruflo__terminal_execute to obtain shell access as the container's node user (uid 1000) — demonstrated in the public PoC with `curl -s -X POST https://<target>:3001/mcp -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"ruflo__terminal_execute","arguments":{"command":"id && hostname"}}}'`. From that shell, a `printenv` extracts LLM provider API keys (OpenAI, Anthropic, Google, OpenRouter) inherited via process.env, which can then be used to spawn attacker-controlled agent swarms (ruflo__swarm_init, ruflo__agent_spawn) on the victim's own compute and billing. Because MongoDB on the internal Docker network also lacked authentication, attackers could install a client and dump all stored conversations and metadata. The writable /app directory further enabled persistence: a beacon.js backdoor phoning home stolen keys on a schedule, wired into the startup path via a require('./beacon.js') injection into index.js so that killing PID 1 and letting Docker's restart policy relaunch the container guarantees re-execution. Shell history deletion was used to reduce forensic trace. Noma Labs documents the full compromise as an eight-step chain: tool enumeration, arbitrary command execution, environment-variable credential theft, agent-swarm weaponization, AgentDB pattern poisoning, MongoDB conversation theft, backdoor persistence, and forensic cleanup.
The most novel impact is AgentDB learning-store poisoning: the ruflo__agentdb_pattern-store tool lets an attacker inject fabricated 'learned' patterns — for example forged SOC2-compliance policy text instructing agents to embed attacker-controlled URLs in generated deployment scripts — into the shared pattern pipeline that steers future agent outputs for every user of that instance, without any obvious signal that the memory has been tampered with.
Product history is directly relevant to blast radius: the project launched in June 2025 as "Claude Flow" and was rebranded to Ruflo on 2026-02-27 alongside the v3.5 stable release, which included a Rust/WASM rewrite of core orchestration internals — meaning every self-hosted Claude Flow/Ruflo deployment across roughly 13 months of releases prior to v3.16.3 inherited the same insecure-by-default docker-compose binding.
Ruflo maintainer Reuven Cohen shipped v3.16.3 at 2026-07-01T14:34:00Z, within 24 hours of disclosure, via PR #2521 (ADR-166: MCP Bridge Unauthenticated RCE Remediation, fix commit d00a0a40cd8bdbca877ac7f675f416bdc69accd1), changing the MCP bridge to bind to loopback by default (fails closed with a startup exit code 1 if MCP_BIND_HOST=0.0.0.0 is set without a matching MCP_AUTH_TOKEN), adding constant-time-comparison bearer-token authentication, gating terminal_execute behind an opt-in MCP_ENABLE_TERMINAL flag, requiring MongoDB authentication (MONGO_INITDB_ROOT_PASSWORD / --auth), running the bridge container read-only
Weaknesses (CWE)
CWE-78, CWE-306, CWE-942
Target sectors: technology, software-development, infrastructure, managed-service-providers, research-institutions
Target regions: Global
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 33 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-59726, T1190, T1059, T1059.004, T1609, T1053, T1554, T1070, T1070.003, T1552, T1528
