Unauthenticated attackers can execute commands and poison AI memory via Ruflo MCP flaw

Summary

A critical vulnerability in the ruflo agent meta-sarness allows an unauthenticated network attacker to gain remote code execution (RCE) by targeting its MCP bridge. The flaw stems from a default docker-compose configuration that binds the bridge and MongoDB to all interfaces without requiring authentication for specific endpoints.

An attacker can exploit this to invoke terminal_execute within the bridge container, providing a direct path to a shell. Beyond local system access, the vulnerability enables attackers to steal provider API keys stored in environment variables and inject malicious patterns into the AgentDB learning store to manipulate future AI outputs.

What happened

The vulnerability exists because the MCP bridge's POST /mcp and POST /mcp/:group endpoints were exposed without authentication. While a tool blocklist existed for the "autopilot" flow, these specific paths bypassed that restriction, allowing unauthorized calls to terminal_execute.

Because the default deployment bound the service to all network interfaces rather than just the local loopback, any reachable instance was vulnerable. This exposure extended to the MongoDB instance, which also lacked mandatory authentication in previous versions.

Technical details

The attack chain relies on the ability to call tools via the unauthenticated bridge endpoints. Once an attacker invokes terminal_execute, they obtain a shell as the node user (UID 1000). From this position, several high-impact actions are possible:

• Credential Theft: Accessing every provider API key stored in the container's environment variables.
• AI Supply Chain Poisoning: Injecting malicious entries into the AgentDB pattern store. This poisoning persists even after a patched redeploy, as it alters the underlying learning-store patterns used to steer AI outputs.
• Database Access: Exploiting the unauthenticated MongoDB instance.

The vulnerability is tracked under CVE-2026-59726 and carries a CVSS score of 10.0.

Affected products and fixed versions

The flaw affects all ruflo installations using the default docker-compose.yml deployment prior to version 3.16.3.

Defender guidance

If you are running an exposed instance of Ruflo, a software update alone is insufficient to remediate the full scope of the compromise. Follow these steps:

1. Immediate Network Hardening Firewall ports :3001 (MCP bridge) and :27017 (MongoDB) immediately if they are currently exposed to the public internet. The new version binds these to 127.0.0.1 by default; ensure your deployment reflects this change.

2. Credential Rotation Because attackers can read all provider API keys from the container environment, you must rotate all associated credentials, including:

• OpenAI
• Google
• OpenRouter
• Anthropic

3. AgentDB Integrity Audit A patched redeploy does not undo pattern poisoning. You must manually audit the AgentDB pattern store for injected agentdb_pattern-store entries and purge any suspicious or unauthorized patterns.

4. Secure Deployment Configuration If you require public network exposure, do not use the default configuration. Use the new docker-compose.public.yml which requires both MCP_BIND_HOST=0.0.0.0 and a mandatory MCP_AUTH_TOKEN. The bridge will now fail to start if you attempt a public bind without providing this token.