Ruflo is an agent meta-harness for Claude Code and Codex.

CVE-2026-59726, codenamed RufRoot by Noma Labs researcher Eli Ainhorn, is an unauthenticated remote code execution flaw in Ruflo, an open-source AI agent orchestration platform (66.5K GitHub stars, ~1M active users). The default docker-compose.yml binds the MCP Bridge to 0.0.0.0:3001 with zero authentication — no token, no API key, no header check, no IP allowlist. A single curl POST to /mcp invoking ruflo__terminal_execute gives an attacker a shell as the node user (uid 1000) inside the bridge container, plus access to 232 other tools spanning shell execution, database ops, agent lifecycle management, and persistent memory writes. All versions prior to 3.16.3 are affected; the fix was shipped within 24 hours of responsible disclosure on June 30, 2026.

The vendor's CVSS 10.0 is mathematically honest — the vector AV:N/AC:L/PR:N/UI:N/S:C accurately describes what happens *when the port is reachable*. But in practice, Ruflo is a developer and research tool, not core infrastructure. The overwhelming majority of deployments sit on developer laptops, CI sandboxes, or internal servers behind firewalls and security groups. The blast radius is container-scoped (not host-level), and there is no evidence of internet-facing mass exposure via Shodan or Censys. The vendor severity overstates the real-world risk for most enterprises by conflating theoretical reachability with actual deployment posture.

Why this verdict

• Trivial exploitability, single curl: Pre-auth RCE with zero complexity and a published PoC keeps the floor above MEDIUM. Any script kiddie with curl can exploit an exposed instance — no compilation, no payload crafting, no race conditions.
• Container-scoped blast radius: The shell runs as node (uid 1000) inside a Docker container. Without a separate container escape vulnerability, the attacker does not gain host-level access. This caps the direct impact below what a host-level RCE would deliver.
• Docker-compose subset only: The vulnerability requires the docker-compose.yml deployment path. The primary install method (npx ruflo init / npm install -g ruflo) does not expose an MCP bridge to the network. This materially narrows the affected population.
• Network reachability gate: Port 3001 must be reachable from the attacker's position. Most developer workstation and internal server deployments are behind firewalls, security groups, or NAT. No Shodan/Censys data confirms mass internet exposure.
• Role multiplier: (a) *Low-value role (majority):* developer workstation / sandbox — chain succeeds, blast radius = one container + API keys of one developer. (b) *Typical role:* internal team AI platform — chain succeeds if port is reachable on internal network (post-initial-access), blast radius = team's API keys + conversation data + AI memory poisoning for that instance's users. (c) *High-value role:* enterprise AI agent platform integrated into CI/CD or serving production decision-making — chain succeeds, blast radius = API key theft (financial + data access), persistent AI output manipulation (integrity risk across all users), potential supply-chain-like impact on AI-driven decisions. However, Ruflo is NOT canonically a high-value-role component (it is not a hypervisor, IdP, PAM, backup, kernel agent, CA, or network edge device). The fraction of installs in true high-value CI/CD integration roles is estimated at <5% of the installed base. The floor is therefore HIGH, not CRITICAL.
• No active exploitation, no KEV, low EPSS (0.44%): No evidence of weaponization in the wild. The EPSS score reflects the niche product category. This does not justify a downgrade below HIGH given the trivial PoC, but it removes any urgency escalation that active exploitation would demand.

Why not higher?

CRITICAL would require either active exploitation (KEV-listed or documented campaigns) or a canonical high-value-role deployment where the blast radius reaches fleet/domain/supply-chain scale. Ruflo is a developer orchestration tool, not infrastructure. The exploit is container-scoped (uid 1000, no host escape), and the affected deployment method (docker-compose with public binding) is a subset of total installs. No Shodan/Censys data confirms mass internet exposure, and the EPSS sits at 0.44%.

Why not lower?

MEDIUM would understate the risk because the vulnerability is pre-auth RCE with zero complexity and a published, copy-paste PoC. The API key theft vector has direct financial impact. The AgentDB memory poisoning creates a persistent integrity compromise that survives patching if the database is not audited. Even behind a firewall, any internal attacker or compromised host on the same network segment can trivially exploit this. The 1M active user base means the absolute number of vulnerable instances — even as a fraction — is non-trivial.

1. Firewall ports 3001 and 27017 immediately — Block all inbound access to the MCP Bridge and MongoDB ports at the host firewall or security group level. This is the single fastest mitigation — deploy within the noisgate mitigation SLA of 30 days for HIGH, though sooner is strongly preferred given the trivial PoC. If you cannot patch today, this one control neutralizes the attack path entirely.
2. Rotate all LLM API keys configured in Ruflo containers — Treat every API key (OpenAI, Anthropic, Google, OpenRouter) passed as an environment variable to a pre-3.16.3 Ruflo container as potentially compromised. Rotate immediately — key theft is the highest-confidence secondary impact.
3. Audit AgentDB pattern store for injected entries — Connect to MongoDB and inspect the AgentDB collections for patterns you did not create. Memory poisoning persists across patches and container restarts. Noma Labs specifically warns that *patching alone does not reverse stored poisoning*. Prioritize this within the 30-day mitigation window.
4. Upgrade to Ruflo 3.16.3+ — The patched version binds MCP to loopback by default, requires MCP_AUTH_TOKEN for public binding, gates terminal_execute behind MCP_ENABLE_TERMINAL=true, enforces MongoDB auth, and runs containers read-only with tmpfs. Apply within the noisgate remediation SLA of 180 days for HIGH.
5. Deploy container runtime monitoring (Falco/Sysdig) — Standard host EDR often has limited visibility into container-internal process execution. A container-aware runtime monitor will detect unexpected shell spawns from the Node.js process, which is the telltale sign of exploitation.

Run this script from any Linux/macOS host (or WSL) that has network access to the target Ruflo instance. Usage: bash check_rufroot.sh <host> [port] — no special privileges required. It probes the MCP Bridge endpoint to determine if the instance is vulnerable.

#!/usr/bin/env bash
# check_rufroot.sh — CVE-2026-59726 (RufRoot) detection script
# Usage: bash check_rufroot.sh <host> [port]
# Exit codes: 1 = VULNERABLE, 0 = PATCHED/NOT_EXPOSED, 2 = UNKNOWN

set -euo pipefail

HOST="${1:-}"
PORT="${2:-3001}"

if [[ -z "$HOST" ]]; then
  echo "Usage: $0 <host> [port]"
  echo "  Checks whether a Ruflo MCP Bridge is exposed and unauthenticated."
  exit 2
fi

URL="http://${HOST}:${PORT}/mcp"

# Step 1: Check if port is reachable
if ! timeout 5 bash -c "echo >/dev/tcp/${HOST}/${PORT}" 2>/dev/null; then
  echo "PATCHED — Port ${PORT} on ${HOST} is not reachable (firewalled or not running)."
  exit 0
fi

# Step 2: Attempt unauthenticated tools/list call
RESPONSE=$(curl -s -m 10 -X POST "${URL}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' 2>/dev/null || true)

if [[ -z "$RESPONSE" ]]; then
  echo "UNKNOWN — Port ${PORT} is open but MCP endpoint did not respond."
  exit 2
fi

# Step 3: Check if tools were returned without auth
if echo "$RESPONSE" | grep -q 'terminal_execute'; then
  echo "VULNERABLE — Unauthenticated MCP Bridge on ${HOST}:${PORT} exposes terminal_execute."
  echo "  CVE-2026-59726 (RufRoot) confirmed. Upgrade to ruflo >= 3.16.3 immediately."
  echo "  Response snippet: $(echo "$RESPONSE" | head -c 200)"
  exit 1
fi

if echo "$RESPONSE" | grep -qi 'tools'; then
  echo "VULNERABLE — Unauthenticated MCP Bridge on ${HOST}:${PORT} returns tool list (terminal_execute not found but other tools exposed)."
  echo "  CVE-2026-59726 (RufRoot) likely affected. Upgrade to ruflo >= 3.16.3."
  exit 1
fi

if echo "$RESPONSE" | grep -qi 'unauthorized\|forbidden\|auth'; then
  echo "PATCHED — MCP Bridge on ${HOST}:${PORT} requires authentication. Likely >= 3.16.3."
  exit 0
fi

echo "UNKNOWN — Unexpected response from ${HOST}:${PORT}. Manual review recommended."
echo "  Response: $(echo "$RESPONSE" | head -c 300)"
exit 2

Sources

1. Noma Security — RufRoot Technical Analysis
2. The Hacker News — Ruflo MCP Flaw Coverage
3. GitHub Security Advisory GHSA-c4hm-4h84-2cf3
4. Ruflo v3.16.3 Security Release
5. CybersecurityNews — Critical Ruflo MCP Bridge Vulnerability
6. CyberPress — Critical Ruflo MCP Bridge Flaw
7. Ruflo GitHub Repository