{"id":16532,"date":"2026-07-30T12:31:05","date_gmt":"2026-07-30T12:31:05","guid":{"rendered":"https:\/\/newestek.com\/?p=16532"},"modified":"2026-07-30T12:31:05","modified_gmt":"2026-07-30T12:31:05","slug":"critical-ruflo-flaw-lets-attackers-hijack-ai-agents-through-exposed-mcp-bridge","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=16532","title":{"rendered":"Critical Ruflo flaw lets attackers hijack AI agents through exposed MCP bridge"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

A critical vulnerability in the open-source AI agent platform Ruflo could allow unauthenticated attackers to take control of enterprise AI environments by exploiting an exposed Model Context Protocol (MCP) bridge, according to research published by Noma Security.<\/p>\n

The flaw, tracked as CVE-2026-59726<\/a> and dubbed RufRoot, carries a maximum CVSS score of 10.0 and affects Ruflo versions prior to 3.16.3, Noma Security wrote in a blog post<\/a>.<\/p>\n

The vulnerability allows attackers to execute arbitrary code, steal large language model (LLM) API keys, access user conversations, hijack AI agents, and manipulate the platform\u2019s persistent AI memory through a single HTTP request.<\/p>\n

The researchers said the issue stems from an unauthenticated MCP Bridge that is exposed by default and provides direct access to the tools AI agents use to interact with enterprise systems.<\/p>\n

\u201cThe MCP Bridge isn\u2019t a random auxiliary debug interface; rather, it is Ruflo\u2019s central nervous system. Every tool call, every agent action, every memory operation goes through the MCP bridge,\u201d the researchers wrote. \u201cMistakenly giving unauthenticated access to the MCP Bridge means giving unauthenticated access to everything.\u201d<\/p>\n

One request leads to full compromise<\/h2>\n

According to Noma Security, Ruflo\u2019s built-in MCP Bridge is an Express.js server that handles every tool invocation made by AI agents. The bridge exposes 233 tools covering shell access, database operations, agent management, and memory storage.<\/p>\n

The researchers said the bridge\u2019s \/mcp endpoint accepts tool invocations without authentication. In a proof-of-concept demonstration, they used Ruflo\u2019s terminal_execute tool to obtain command execution inside the container with a single HTTP request.<\/p>\n

\u201cBecause the\u00a0MCP Bridge\u00a0requires direct access to the underlying system resources to execute these commands, it creates a high-stakes security boundary,\u201d the researchers wrote. \u201cWhen an attacker can reach this endpoint without authentication, they gain a direct pipeline to the underlying host infrastructure.\u201d<\/p>\n

The researchers said they were able to enumerate available tools, steal LLM provider API keys from environment variables, deploy attacker-controlled AI agent swarms, retrieve user conversations stored in MongoDB, and establish persistence.<\/p>\n

The researchers also demonstrated what they described as AI memory poisoning by inserting malicious entries into Ruflo\u2019s AgentDB pattern store, allowing future AI responses to incorporate attacker-controlled instructions.<\/p>\n

Every stage of the attack chain was validated against a default Ruflo deployment running on AWS EC2, according to the researchers.<\/p>\n

Beyond Ruflo: A broader MCP security challenge<\/h2>\n

While the authentication flaw is specific to Ruflo, security practitioners say the research highlights broader risks surrounding AI orchestration platforms and MCP infrastructure.<\/p>\n

\u201cMCP adoption has outpaced the security defaults built into a lot of orchestration tools,\u201d said Amit Jena, AI Development Manager at Kanerika. \u201cThese platforms shipped fast, prioritized ease of setup over authentication, and assumed the network boundary would protect them. That assumption breaks down once the tool sits on a server reachable from a corporate network, which is increasingly where enterprises are running them.\u201d<\/p>\n

Jena said the research also points to a security concern that extends beyond a single product.<\/p>\n

\u201cThe memory poisoning problem isn\u2019t product-specific, and that\u2019s the part worth paying attention to,\u201d he said. \u201cAny platform that gives agents a persistent, writable memory store needs to treat that store as a security boundary: who can write to it, and can you tell system-generated memory from memory an attacker planted. Very few platforms are doing that today.\u201d<\/p>\n

He added that, unlike traditional persistence techniques, poisoned AI memory can remain inside a trusted data store and continue influencing future agent behavior after the original intrusion has ended.<\/p>\n

Patch addresses attack chain<\/h2>\n

Noma Security said it disclosed the vulnerability responsibly to Ruflo, which released<\/a> fixes within hours along with a public security advisory.<\/p>\n

According to the researchers, the updated release changes the MCP Bridge to bind to the loopback interface by default and fail closed if administrators attempt to expose it publicly without configuring authentication.<\/p>\n

Noma Security also urged organizations running Ruflo to immediately close firewall access to ports 3001 and 27017, rotate all LLM API keys, audit AgentDB for malicious entries because \u201ca patched redeploy alone doesn\u2019t undo poisoning,\u201d and inspect MongoDB for signs of tampering.<\/p>\n

Jena said organizations should also review how AI orchestration platforms are deployed and managed.<\/p>\n

\u201cIf a component can execute a shell command or query a database, it gets the same authentication, network segmentation, and logging as any other privileged system in the environment,\u201d he said. He also recommended that security teams inventory the tools exposed through AI agent deployments, audit persistent AI memory separately from software patching, and narrowly scope and rotate LLM provider credentials following any suspected exposure.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

A critical vulnerability in the open-source AI agent platform Ruflo could allow unauthenticated attackers to take control of enterprise AI environments by exploiting an exposed Model Context Protocol (MCP) bridge, according to research published by Noma Security. The flaw, tracked as CVE-2026-59726 and dubbed RufRoot, carries a maximum CVSS score of 10.0 and affects Ruflo versions prior to 3.16.3, Noma Security wrote in a blog… <\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16532","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16532","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16532"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16532\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16532"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16532"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16532"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}