Critical Ruflo Flaw Lets Attackers Spawn Rogue AI Agent Swarms

Noma Labs researchers disclosed a critical vulnerability in the open source AI orchestration platform Ruflo, tracked as CVE-2026-59726 with a CVSS score of 10.0 and labeled “RufRoot.” The flaw exposed an unauthenticated POST /mcp endpoint in default docker-compose installations and allowed commands to run inside the MCP bridge container.

The defect was found in ruflo/docker-compose.yml, where the MCP bridge and MongoDB services were bound to all network interfaces and port 3001 was mapped to 0.0.0.0 by default. In those deployments the MCP bridge exposed 233 tools, including ruflo__terminal_execute, which can run shell commands. An attacker could call that tool with a single HTTP request and execute commands as the container’s node user.

Noma Labs listed specific impacts an attacker could achieve: remote code execution, reading provider API keys, accessing conversation data, spawning attacker-controlled agent swarms on victims’ keys, injecting poisoned patterns into the AgentDB learning store to influence agent outputs, installing persistent backdoors and clearing shell history to remove traces.

Ruflo, formerly Claude Flow, offers a multi-model AI chat interface, long-term memory for agents and support for coordinating up to 100 agents. The project has more than 67,000 stars on GitHub, and many teams run self-hosted instances using the provided docker-compose configuration, which left some deployments exposed by default.

Ruflo maintainers released a patch in version 3.16.3 that removes the exposed endpoint and addresses related attack paths. The project published remediation steps and hardening guidance. Operators running self-hosted instances are advised to update to 3.16.3 or later, confirm that the MCP bridge and database are not bound to public interfaces, and follow the published hardening instructions.

Noma Labs wrote, “The MCP Bridge isn’t a random auxiliary debug interface; rather, it is Ruflo’s central nervous system. Every tool call, every agent action, every memory operation goes through the MCP Bridge. Mistakenly giving unauthenticated access to the MCP Bridge means giving unauthenticated access to everything.” The researchers added that with command execution, “achieving full compromise is just chaining more requests to the same endpoint.”