{"slug": "critical-ruflo-flaw-lets-attackers-hijack-ai-agents-through-exposed-mcp-bridge", "title": "Critical Ruflo flaw lets attackers hijack AI agents through exposed MCP bridge", "summary": "A critical vulnerability in the open-source AI agent platform Ruflo, tracked as CVE-2026-59726 and dubbed RufRoot, carries a maximum CVSS score of 10.0 and allows unauthenticated attackers to execute arbitrary code, steal LLM API keys, and hijack AI agents through an exposed Model Context Protocol (MCP) bridge, according to research published by Noma Security. The flaw affects Ruflo versions prior to 3.16.3 and stems from an unauthenticated MCP Bridge exposed by default that provides direct access to tools AI agents use to interact with enterprise systems. Security practitioners say the research highlights broader risks surrounding AI orchestration platforms and MCP infrastructure, with Amit Jena, AI Development Manager at Kanerika, noting that \"MCP adoption has outpaced the security defaults built into a lot of orchestration tools.", "body_md": "A critical vulnerability in the open-source AI agent platform Ruflo could allow unauthenticated attackers to take control of enterprise AI environments by exploiting an exposed Model Context Protocol (MCP) bridge, according to research published by Noma Security.\n\nThe flaw, tracked as [CVE-2026-59726](https://nvd.nist.gov/vuln/detail/CVE-2026-59726) and dubbed RufRoot, carries a maximum CVSS score of 10.0 and affects Ruflo versions prior to 3.16.3, Noma Security wrote in a blog [post](https://noma.security/blog/rufroot-the-mcp-bridge-vulnerability-that-turns-agents-into-rogue-admins-cve-2026-59726/).\n\nThe vulnerability allows attackers to execute arbitrary code, steal large language model (LLM) API keys, access user conversations, hijack AI agents, and manipulate the platform’s persistent AI memory through a single HTTP request.\n\nThe researchers said the issue stems from an unauthenticated MCP Bridge that is exposed by default and provides direct access to the tools AI agents use to interact with enterprise systems.\n\n“The MCP Bridge isn’t a random auxiliary debug interface; rather, it is Ruflo’s central nervous system. Every tool call, every agent action, every memory operation goes through the MCP bridge,” the researchers wrote. “Mistakenly giving unauthenticated access to the MCP Bridge means giving unauthenticated access to everything.”\n\nAccording to Noma Security, Ruflo’s built-in MCP Bridge is an Express.js server that handles every tool invocation made by AI agents. The bridge exposes 233 tools covering shell access, database operations, agent management, and memory storage.\n\nThe researchers said the bridge’s /mcp endpoint accepts tool invocations without authentication. In a proof-of-concept demonstration, they used Ruflo’s terminal_execute tool to obtain command execution inside the container with a single HTTP request.\n\n“Because the MCP Bridge requires direct access to the underlying system resources to execute these commands, it creates a high-stakes security boundary,” the researchers wrote. “When an attacker can reach this endpoint without authentication, they gain a direct pipeline to the underlying host infrastructure.”\n\nThe researchers said they were able to enumerate available tools, steal LLM provider API keys from environment variables, deploy attacker-controlled AI agent swarms, retrieve user conversations stored in MongoDB, and establish persistence.\n\nThe researchers also demonstrated what they described as AI memory poisoning by inserting malicious entries into Ruflo’s AgentDB pattern store, allowing future AI responses to incorporate attacker-controlled instructions.\n\nEvery stage of the attack chain was validated against a default Ruflo deployment running on AWS EC2, according to the researchers.\n\nWhile the authentication flaw is specific to Ruflo, security practitioners say the research highlights broader risks surrounding AI orchestration platforms and MCP infrastructure.\n\n“MCP adoption has outpaced the security defaults built into a lot of orchestration tools,” said Amit Jena, AI Development Manager at Kanerika. “These platforms shipped fast, prioritized ease of setup over authentication, and assumed the network boundary would protect them. That assumption breaks down once the tool sits on a server reachable from a corporate network, which is increasingly where enterprises are running them.”\n\nJena said the research also points to a security concern that extends beyond a single product.\n\n“The memory poisoning problem isn’t product-specific, and that’s the part worth paying attention to,” he said. “Any platform that gives agents a persistent, writable memory store needs to treat that store as a security boundary: who can write to it, and can you tell system-generated memory from memory an attacker planted. Very few platforms are doing that today.”\n\nHe added that, unlike traditional persistence techniques, poisoned AI memory can remain inside a trusted data store and continue influencing future agent behavior after the original intrusion has ended.\n\nNoma Security said it disclosed the vulnerability responsibly to Ruflo, which [released](https://github.com/ruvnet/ruflo/security/advisories/GHSA-c4hm-4h84-2cf3) fixes within hours along with a public security advisory.\n\nAccording to the researchers, the updated release changes the MCP Bridge to bind to the loopback interface by default and fail closed if administrators attempt to expose it publicly without configuring authentication.\n\nNoma Security also urged organizations running Ruflo to immediately close firewall access to ports 3001 and 27017, rotate all LLM API keys, audit AgentDB for malicious entries because “a patched redeploy alone doesn’t undo poisoning,” and inspect MongoDB for signs of tampering.\n\nJena said organizations should also review how AI orchestration platforms are deployed and managed.\n\n“If a component can execute a shell command or query a database, it gets the same authentication, network segmentation, and logging as any other privileged system in the environment,” he said. He also recommended that security teams inventory the tools exposed through AI agent deployments, audit persistent AI memory separately from software patching, and narrowly scope and rotate LLM provider credentials following any suspected exposure.", "url": "https://wpnews.pro/news/critical-ruflo-flaw-lets-attackers-hijack-ai-agents-through-exposed-mcp-bridge", "canonical_source": "https://www.csoonline.com/article/4203408/critical-ruflo-flaw-lets-attackers-hijack-ai-agents-through-exposed-mcp-bridge.html", "published_at": "2026-07-30 12:29:58+00:00", "updated_at": "2026-07-30 12:30:38.735876+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-infrastructure", "ai-policy"], "entities": ["Ruflo", "Noma Security", "CVE-2026-59726", "MCP Bridge", "Amit Jena", "Kanerika", "AWS EC2", "MongoDB"], "alternates": {"html": "https://wpnews.pro/news/critical-ruflo-flaw-lets-attackers-hijack-ai-agents-through-exposed-mcp-bridge", "markdown": "https://wpnews.pro/news/critical-ruflo-flaw-lets-attackers-hijack-ai-agents-through-exposed-mcp-bridge.md", "text": "https://wpnews.pro/news/critical-ruflo-flaw-lets-attackers-hijack-ai-agents-through-exposed-mcp-bridge.txt", "jsonld": "https://wpnews.pro/news/critical-ruflo-flaw-lets-attackers-hijack-ai-agents-through-exposed-mcp-bridge.jsonld"}}