RufRoot: The AI Vulnerability That Survives the Patch — 233…

CVE-2026-59726 in Ruflo exposes 233 MCP tools without authentication, enabling RCE, LLM API key theft, and persistent memory poisoning that survives the 3.16.3 update. NIST rates it CVSS 10.0.

On July 29, 2026, the agentic platform Ruflo confronts a vulnerability that redefines the boundaries of patching. Assigned the maximum CVSS 10.0 by NIST, CVE-2026-59726 — dubbed RufRoot by Noma Labs researchers — does more than execute remote code: it contaminates the persistent memory of AI agents, making compromise irreversible with a simple software update.

Key Takeaways

CVE-2026-59726 strikes Ruflo's MCP Bridge, exposing 233 tools without authentication on the network via default binding to 0.0.0.0:3001.
A single unauthenticated HTTP POST to /mcp triggers ruflo__terminal_execute for immediate RCE in the container, with theft of LLM API keys from the process environment.
The impact chain extends to unauthenticated MongoDB (port 27017), conversation theft, and memory poisoning of the AgentDB learning store.
The 3.16.3 fix closes the initial vector but cannot undo already-injected patterns: poisoned memory influences future AI outputs regardless of the patch.

The Central Nervous System: How the MCP Bridge Works

Ruflo is an open-source meta-harness for orchestrating AI agents like Claude Code and OpenAI Codex, with roughly 66,500 GitHub stars, nearly 10 million downloads, and approximately one million active users at the time of disclosure. The Model Context Protocol (MCP) Bridge, implemented in Express.js, acts as an intermediary between language models and the underlying infrastructure.

According to Noma Labs' original advisory, the bridge exposes 233 tools covering shell access, database operations, agent management, and memory storage. The critical flaw lies in two default choices: the POST /mcp endpoint is reachable without any authentication, and the service binds to 0.0.0.0:3001 — all network interfaces — instead of the local loopback.

Maintainer Reuven Cohen confirmed the misconfiguration in release notes cited by The Hacker News: "The docker-compose defaults bound the bridge and MongoDB to all interfaces." The same composition includes MongoDB without authentication on port 27017, amplifying the attack surface.

From POST to Total Control: The 8-Step Exploit Chain

Noma Labs researchers demonstrated an attack chain confirmed live on an AWS EC2 instance with a default Ruflo deployment. The entry point is technically trivial: a JSON-RPC tools/call request to ruflo__terminal_execute with an arbitrary command.

The proof-of-concept documented by Eli Ainhorn uses curl with an OAST callback to Burp Collaborator. From this initial foothold, the attacker gains a shell in the container, extracts API keys for all LLM providers — OpenAI, Anthropic, Google, OpenRouter — via printenv from environment variables. The backend inherits the entire environment through destructuring {...process.env}.

The compromise continues with spawning attacker-controlled agent swarms on the victim's credentials, theft of conversations from the internal MongoDB, and injection of malicious patterns into the AgentDB learning store. Persistence is guaranteed by backdoors in the /app directory with Docker restart policies.

"Prior to 3.16.3, Ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns" — NIST National Vulnerability Database

The Memory That Resists: The Post-Patch Poisoning Paradigm

Maintainer Reuven Cohen precisely summarized the anomaly: the compromise enables "a poisoned pattern into the AgentDB learning store that steers future AI outputs." This mechanism introduces an unprecedented persistence vector in the agentic security landscape.

It is not resident malware on disk, nor a kernel rootkit. It is poisoning of the model's future behavior: instructions injected into the learning memory that condition subsequent responses, decisions, and actions of the agent. Even after updating to version 3.16.3, the contaminated patterns remain active.

John Gallagher, VP at Viakoo, called the phenomenon "a critical turning point in cybersecurity" in an analysis cited by Dark Reading. Researcher Johan Edholm of Detectify added: "The bug class is old, but the blast radius is new." The vulnerability class — lack of authentication on a network service — has been known for decades. The novelty is the persistent semantic contamination that transcends the compromised binary.

Noma Labs explicitly documented the limitation: "a patched redeploy alone doesn't undo poisoning." Traditional incident response — identify, patch, verify — no longer suffices when the compromised software is the behavior of the artificial intelligence.

What to Do Now

For Ruflo installations, the priority actions are:

Update immediately to version 3.16.3, which implements loopback binding by default, bearer token authentication, disables terminal_execute, adds MongoDB authentication, and includes CI regression tests.
Rotate all exposed LLM API keys in the container: OpenAI, Anthropic, Google, OpenRouter. Consider any key present in pre-patch environment variables compromised.
Full AI memory audit: verify patterns and instructions in the AgentDB learning store, rebuild from a clean image if not verifiable.
Rebuild the instance from scratch rather than updating in-place: persistent poisoning requires rebuilding the environment with memory data restored from a pre-compromise backup.

The Shadow AI Shadow and MCP Platform Governance

Ruflo often enters enterprises as Shadow AI: unauthorized deployments by development teams seeking productivity without waiting for IT approval cycles. This vulnerability demonstrates that a single default configuration error exposes not only traditional infrastructure, but the entire AI decision-making ecosystem.

MCP platforms require specific hardening that goes beyond automatic patching. LLM credentials must be managed as top-tier secrets, with dedicated rotation and monitoring. Network segmentation must isolate MCP bridges from any lateral access. And incident response must integrate agentic memory verification alongside disk forensics and log analysis.

The CVE-2026-59726 record in the NVD database includes classifications CWE-78 (OS Command Injection), CWE-306 (Missing Authentication), and CWE-942 (Permissive Cross-domain Policy). Responsible disclosure began on June 30, 2026; the fix was merged in PR #2521 within 24 hours, with advisory GHSA-c4hm-4h84-2cf3.

Why This Vulnerability Changes the Rules

RufRoot is not a supply-chain compromise in the classic sense. It is not a malicious binary injected into a repository, but infrastructure configured by default for exposure and AI memory that absorbs the compromise as permanent learning. The model itself becomes the persistence vehicle.

For CISOs, the lesson is twofold: agentic platforms introduce attack surfaces that do not map to traditional assets, and existing defense tools — EDR, SIEM, vulnerability scanners — do not detect semantic contamination. A new category of audit is needed: behavioral integrity verification of agents, not just their infrastructure.

FAQ

Is the MCP protocol inherently insecure?: No. The vulnerability lies in Ruflo's specific implementation, not the MCP protocol itself. The problem is the default choices — binding on all interfaces, lack of authentication — not the agentic paradigm.
Why is the CVSS 10.0, the maximum possible?: According to the official NVD record, the CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: remote attack without authentication, low complexity, catastrophic impact on confidentiality, integrity, and availability, with changed scope.
Does updating to 3.16.3 fix everything?: The fix closes the initial access vector but cannot undo already-injected memory poisoning patterns. Compromised instances require reconstruction from a clean image and AI memory verification, in addition to credential rotation.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references