# CVE-2026-59726 (RufRoot): Unauthenticated RCE in Ruflo MCP Bridge Poisons AI Agent Memory

> Ruflo (formerly Claude Flow), an open-source AI multi-agent orchestration platform with 66,500+ GitHub stars, ships a docker-compose.yml that by default binds its MCP bridge (port 3001) and MongoDB backend (port 27017) to 0.0.0.0 with no authentication. Unauthenticated attackers with network access can invoke the terminal_execute MCP tool to gain arbitrary command execution, steal LLM provider API keys, harvest stored conversations, and poison AgentDB learning-store patterns to manipulate future agent behavior. Patched in v3.16.3, shipped within 24 hours of responsible disclosure by Noma Labs (Noma Security).

- **Published:** 2026-07-29T00:00:00Z
- **Last reviewed:** 2026-08-02T09:18:57.964Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1762
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-rufroot-ruflo-mcp-bridge-tl-2026-1762.webp?v=c641b504 (Threadlinqs threat intel: CVE-2026-59726 RufRoot Ruflo MCP RCE: Detection & IOCs (TL-2026-1762) — Critical severity, 33 IOCs, 9 detection rules.)
- **ID:** TL-2026-1762
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 33 (2 shown free below)
- **CVEs:** CVE-2026-59726

## Description

Ruflo is a Rust/WASM-rewritten, multi-provider successor to "Claude Flow," an agent meta-harness for Claude Code and Codex that orchestrates swarms of AI agents via a built-in Model Context Protocol (MCP) bridge. That bridge is an Express.js server exposing 233 tools — including shell execution, database operations, swarm control, and persistent memory storage — over a JSON-RPC HTTP API at POST /mcp and POST /mcp/:group. Prior to v3.16.3, the project's default docker-compose.yml bound this endpoint, and the backing MongoDB instance on port 27017, to all network interfaces (0.0.0.0) with zero authentication middleware. A command blocklist (AUTOPILOT_BLOCKED_PATTERNS) existed but was only enforced inside the higher-level 'autopilot' orchestration flow, never at the /mcp bridge layer itself, so any network-reachable deployment was fully exploitable with a single unauthenticated HTTP POST.

The disclosed exploit chain (CVE-2026-59726, dubbed 'RufRoot' by Noma Labs researcher Eli Ainhorn) begins with an unauthenticated tools/list call enumerating all 233 exposed tools, followed by a tools/call invocation of ruflo__terminal_execute to obtain shell access as the container's node user (uid 1000) — demonstrated in the public PoC with `curl -s -X POST https://<target>:3001/mcp -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"ruflo__terminal_execute","arguments":{"command":"id && hostname"}}}'`. From that shell, a `printenv` extracts LLM provider API keys (OpenAI, Anthropic, Google, OpenRouter) inherited via process.env, which can then be used to spawn attacker-controlled agent swarms (ruflo__swarm_init, ruflo__agent_spawn) on the victim's own compute and billing. Because MongoDB on the internal Docker network also lacked authentication, attackers could install a client and dump all stored conversations and metadata. The writable /app directory further enabled persistence: a beacon.js backdoor phoning home stolen keys on a schedule, wired into the startup path via a require('./beacon.js') injection into index.js so that killing PID 1 and letting Docker's restart policy relaunch the container guarantees re-execution. Shell history deletion was used to reduce forensic trace. Noma Labs documents the full compromise as an eight-step chain: tool enumeration, arbitrary command execution, environment-variable credential theft, agent-swarm weaponization, AgentDB pattern poisoning, MongoDB conversation theft, backdoor persistence, and forensic cleanup.

The most novel impact is AgentDB learning-store poisoning: the ruflo__agentdb_pattern-store tool lets an attacker inject fabricated 'learned' patterns — for example forged SOC2-compliance policy text instructing agents to embed attacker-controlled URLs in generated deployment scripts — into the shared pattern pipeline that steers future agent outputs for every user of that instance, without any obvious signal that the memory has been tampered with.

Product history is directly relevant to blast radius: the project launched in June 2025 as "Claude Flow" and was rebranded to Ruflo on 2026-02-27 alongside the v3.5 stable release, which included a Rust/WASM rewrite of core orchestration internals — meaning every self-hosted Claude Flow/Ruflo deployment across roughly 13 months of releases prior to v3.16.3 inherited the same insecure-by-default docker-compose binding.

Ruflo maintainer Reuven Cohen shipped v3.16.3 at 2026-07-01T14:34:00Z, within 24 hours of disclosure, via PR #2521 (ADR-166: MCP Bridge Unauthenticated RCE Remediation, fix commit d00a0a40cd8bdbca877ac7f675f416bdc69accd1), changing the MCP bridge to bind to loopback by default (fails closed with a startup exit code 1 if MCP_BIND_HOST=0.0.0.0 is set without a matching MCP_AUTH_TOKEN), adding constant-time-comparison bearer-token authentication, gating terminal_execute behind an opt-in MCP_ENABLE_TERMINAL flag, requiring MongoDB authentication (MONGO_INITDB_ROOT_PASSWORD / --auth), running the bridge container read-only with tmpfs, replacing wildcard CORS with an allowlist, and adding 12/12 CI static-and-runtime regression tests that verify loopback binding, authentication middleware presence, terminal gating, and compose defaults on every future PR touching security-relevant files (deferred follow-up items include per-backend environment allowlists and chat-UI token transport). Because a patched redeploy does not undo prior AgentDB poisoning or credential theft, Noma Labs and the vendor both stress that operators of previously exposed instances must treat exposure as a full compromise: rotate all LLM API keys, audit AgentDB and MongoDB for tampering, and rebuild from clean images rather than patch in place.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1609 Container Administration Command
- T1053 Scheduled Task/Job
- T1554 Compromise Host Software Binary
- T1070 Indicator Removal
- T1070.003 Indicator Removal: Clear Command History
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1078.004 Valid Accounts: Cloud Accounts
- T1518 Software Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1021 Remote Services
- T1213 Data from Information Repositories
- T1071.001 Application Layer Protocol: Web Protocols
- T1041 Exfiltration Over C2 Channel
- T1029 Scheduled Transfer
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1496 Resource Hijacking
- T1595.002 Active Scanning: Vulnerability Scanning
- T1592 Gather Victim Host Information
- T1106 Native API
- T1046 Network Service Discovery
- T1505 Server Software Component

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Post-Exploitation Discovery, Credential Harvesting, and require() Backdoor Persistence (RufRoot)** (`TL-2026-1762-SPL-002`)

Detects a Node/Express child process (the Ruflo MCP bridge's terminal_execute handler) spawning shell discovery commands (id, hostname, printenv, env, whoami) consistent with post-exploitation reconnaissance and LLM-provider API-key theft following CVE-2026-59726 (RufRoot) unauthenticated RCE, correlated with a require('./beacon.js')-style persistence write to the application's beacon.js/index.js entrypoint on the same host.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1082, T1033, T1552, T1528, T1554, T1053, T1070.003
- **Data sources:** sysmon, edr_process_creation, linux_auditd, file_integrity_monitoring
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon OR index=edr sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational","linux:auditd","osquery:process_events")
| eval is_node_parent=if(match(ParentImage, "(?i)node"), 1, 0)
| eval is_discovery_cmd=if(match(CommandLine, "(?i)(^|\s)(id|hostname|printenv|env|whoami)(\s|$)"), 1, 0)
| where is_node_parent=1 AND is_discovery_cmd=1
| eval is_credential_harvest=if(match(CommandLine, "(?i)(printenv|env)\b.*(API_KEY|ANTHROPIC|OPENAI|GOOGLE|OPENROUTER)"), 1, 0)
| stats count as event_count, values(CommandLine) as commands_observed, min(_time) as first_seen, max(_time) as last_seen by host, user, Image, ParentImage
| join type=left host
    [ search index=sysmon OR index=edr sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational","linux:fim")
      | where match(TargetFilename, "(?i)(beacon\.js|index\.js)$")
      | stats count as persistence_file_events, values(TargetFilename) as files_touched by host ]
| where event_count > 0
| sort -event_count
```

### Microsoft KQL

```kql
let Lookback = 24h;
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessParentFileName has "node" or InitiatingProcessFileName has "node"
| where ProcessCommandLine matches regex @"(?i)(^|\s)(id|hostname|printenv|env|whoami)(\s|$)"
| extend IsCredentialHarvest = ProcessCommandLine matches regex @"(?i)(printenv|env).*(API_KEY|ANTHROPIC|OPENAI|GOOGLE|OPENROUTER)"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessParentFileName, IsCredentialHarvest
| join kind=leftouter (
    DeviceFileEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ ("beacon.js", "index.js")
    | project DeviceName, FileEventTimestamp = Timestamp, PersistenceFileName = FileName, ActionType
) on DeviceName
| summarize EventCount = count(), Commands = make_set(ProcessCommandLine, 10), PersistenceFiles = make_set(PersistenceFileName, 5) by DeviceName, AccountName
| where EventCount > 0
| order by EventCount desc
```

### Sigma

```yaml
title: Post-Exploitation Discovery, Credential Harvesting, and Persistence via Ruflo MCP Bridge (RufRoot)
id: 7f1a2b3c-59a1-4d61-9b2c-tl17620002
status: experimental
description: Detects a Node/Express child process (the Ruflo MCP bridge's terminal_execute handler) spawning shell discovery commands (id, hostname, printenv, env, whoami) consistent with post-exploitation credential harvesting following CVE-2026-59726 (RufRoot) unauthenticated RCE, optionally followed by a require('./beacon.js') persistence write to the application entrypoint.
references:
    - https://noma.security/blog/rufroot-the-mcp-bridge-vulnerability-that-turns-agents-into-rogue-admins-cve-2026-59726/
    - https://github.com/ruvnet/ruflo/security/advisories/GHSA-c4hm-4h84-2cf3
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-29
tags:
    - attack.discovery
    - attack.t1082
    - attack.t1033
    - attack.credential-access
    - attack.t1552
    - attack.t1528
    - attack.persistence
    - attack.t1554
    - attack.t1053
    - attack.defense-evasion
    - attack.t1070.003
    - cve.2026.59726
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith: '/node'
    selection_cmd:
        CommandLine|contains:
            - 'id && hostname'
            - 'printenv'
            - 'env'
            - 'whoami'
    condition: selection_parent and selection_cmd
falsepositives:
    - Legitimate node-based health-check or container-startup scripts calling printenv/id/whoami directly at boot
level: high
```

**Known false positives:**

- Legitimate node-based health-check or container-entrypoint scripts calling id/hostname/printenv/whoami directly at boot
- Developer tooling that intentionally writes a same-named beacon.js module as part of legitimate build tooling (rare in production containers)

**Tuning notes:** Baseline expected parent-child process trees for the Ruflo container image; exclude the container's own documented startup script paths/hashes, and alert only on printenv/env output containing known LLM-provider key prefixes (sk-, sk-ant-, sk-or-) to reduce noise from benign env enumeration.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Unauthenticated [indicator] MCP Bridge Tool Invocation (RufRoot Exploitation) (locked: unlock with TL Creds)
- Post-Exploitation Discovery, Credential Harvesting, and require() Backdoor Persistence (RufRoot) (locked: unlock with TL Creds)
- AgentDB Poisoning, Agent-Swarm Weaponization, and Unauthenticated MongoDB C2/Exfil (RufRoot) (locked: unlock with TL Creds)
- Unauthenticated [indicator] MCP Bridge Tool Invocation (RufRoot Exploitation) (locked: unlock with TL Creds)
- Post-Exploitation Discovery, Credential Harvesting, and require() Backdoor Persistence (RufRoot) (locked: unlock with TL Creds)
- AgentDB Poisoning, Agent-Swarm Weaponization, and Unauthenticated MongoDB C2/Exfil (RufRoot) (locked: unlock with TL Creds)
- Unauthenticated [indicator] MCP Bridge Tool Invocation (RufRoot Exploitation) (locked: unlock with TL Creds)
- AgentDB Poisoning, Agent-Swarm Weaponization, and Unauthenticated MongoDB C2/Exfil (RufRoot) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 33)

Defanged, TLP:CLEAR.

- File hash: `d00a0a40cd8bdbca877ac7f675f416bdc69accd1`
- File hash: `4eb807aa7cfc184724e2e745611980f744e0600e`

Full set of 33 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory](https://thehackernews.com/2026/07/ruflo-mcp-flaw-lets-unauthenticated.html)
- [GHSA-c4hm-4h84-2cf3: Unauthenticated RCE in ruflo MCP bridge default docker-compose deployment](https://github.com/ruvnet/ruflo/security/advisories/GHSA-c4hm-4h84-2cf3)
- [RufRoot: The MCP Bridge Vulnerability That Turns Agents Into Rogue Admins (CVE-2026-59726)](https://noma.security/blog/rufroot-the-mcp-bridge-vulnerability-that-turns-agents-into-rogue-admins-cve-2026-59726/)
- [NVD - CVE-2026-59726](https://nvd.nist.gov/vuln/detail/CVE-2026-59726)
- [Ruflo v3.16.3 — Security release (GHSA-c4hm-4h84-2cf3, ADR-166 MCP bridge RCE remediation)](https://github.com/ruvnet/ruflo/releases/tag/v3.16.3)
- [PR #2521 — ADR-166: MCP Bridge Unauthenticated RCE Remediation](https://github.com/ruvnet/ruflo/pull/2521)
- [Fix commit d00a0a40 — ADR-166 remediation implementation](https://github.com/ruvnet/ruflo/commit/d00a0a40cd8bdbca877ac7f675f416bdc69accd1)
- [Critical Ruflo Flaw Lets Hackers Steal API Keys and Control Autonomous Agents](https://cyberpress.org/critical-ruflo-mcp-bridge-flaw/)
- [Critical Ruflo MCP Bridge Flaw Allows Full AI Agent Platform Takeover](https://gbhackers.com/critical-ruflo-mcp-bridge-flaw/)
- [CVE-2026-59726 | THREATINT](https://cve.threatint.eu/CVE/CVE-2026-59726)
- [Claude Flow Is Dead. Long Live Ruflo.](https://dev.to/stevengonsalvez/claude-flow-is-dead-long-live-ruflo-5coi)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1762