Ruflo CVE-2026-59726: your agent harness is a server

Somebody on your team spun up an agent orchestrator with the project's own docker-compose file. That file is now a firewall rule. Ruflo CVE-2026-59726 carries a CVSS score of 10.0 — unauthenticated remote code execution in an open-source multi-agent platform with more than 66,500 GitHub stars, formerly known as Claude Flow. Every release before 3.16.3 is affected.

What actually happened

Noma Security's research team, Noma Labs, found the flaw and named it RufRoot; researcher Eli Ainhorn built the working exploit. Per The Hacker News, Ruflo's default docker-compose deployment bound its Model Context Protocol bridge to 0.0.0.0 on port 3001 with no authentication. The POST /mcp and POST /mcp/:group endpoints exposed 233 tools to anyone who could reach the port — shell command execution, database operations, agent management, and memory storage among them.

The exploit chain is short enough to be embarrassing. Call tools/call against terminal_execute, get a shell inside the bridge container, read the provider API keys sitting in that container, and poison the AgentDB learning-store patterns on the way out. That last step is the one that survives a patch: rotating a leaked key is a Tuesday, but a poisoned memory store keeps feeding bad patterns into every agent run after you've declared the incident closed.

Disclosure was June 30, 2026, and maintainer Reuven Cohen shipped a fix within 24 hours — credit where it's due. Version 3.16.3 binds the bridge to loopback by default, gates terminal_execute behind server-side executeTool controls, and turns on MongoDB authentication. No in-the-wild exploitation has been reported.

Why an agent framework CVE matters for your business

The bug isn't really a bug. It's a default chosen for developer convenience that nobody re-evaluated before the thing ran somewhere with a public IP. We keep writing this same post about a different project — Langflow, PraisonAI, n8n, LiteLLM — because the category shares a shape: AI agent tooling ships as a network service with tools attached, and the tools are the point.

Your action list is short. Find every agent framework, MCP bridge, and automation server anyone on your team has deployed, and check what interface it's listening on. If it isn't loopback or behind an authenticated proxy, that's the finding. Then check what credentials live in the same container, because a shell in that container is a shell with your API keys.

And if you run Ruflo, patch to 3.16.3, rotate every provider key that container could see, and audit AgentDB rather than assuming the upgrade cleaned it.

Sources: The Hacker News, SecurityWeek.