Critical Vulnerability in Ruflo Allows Full Hijacking of AI Agents

A critical vulnerability in the open source AI agent platform Ruflo, identified as CVE-2026-59726 and dubbed “RufRoot,” has been discovered by researchers at Noma Security. With a CVSS score of 10.0, the flaw allows unauthenticated attackers to take complete control of enterprise environments using Ruflo, simply by sending a single HTTP request to the MCP (Model Context Protocol) bridge exposed by default.

What happened?

Ruflo is an open source platform for orchestrating AI agents. Its core component, the MCP Bridge, is an Express.js server that handles every tool invocation made by agents. According to Noma Security, the bridge exposes 233 tools including shell access, database operations, agent management, and memory storage. The /mcp endpoint accepts invocations without authentication, allowing an attacker to execute arbitrary commands within the container with a single request.

In their proof of concept, the researchers used the terminal_execute tool to gain command execution. From there, they were able to enumerate available tools, steal API keys from LLM providers via environment variables, deploy swarms of attacker-controlled agents, retrieve user conversations stored in MongoDB, and establish persistence. They also demonstrated poisoning of AI memory by inserting malicious entries into the AgentDB pattern store, allowing future AI responses to incorporate attacker instructions.

Why it matters

The severity of the flaw lies in the fact that the MCP Bridge is not an auxiliary interface but the central nervous system of Ruflo. Every tool call, every agent action, every memory operation passes through it. Giving unauthenticated access to the bridge is equivalent to giving unauthenticated access to everything. This not only affects the platform itself but sets a worrying precedent for the security of AI orchestration protocols.

Security researcher John Bambenek, president of Bambenek Consulting, told InfoWorld that “the real problem is that AI application developers are building on insecure abstraction layers without understanding the security implications.” He added that MCP is an excellent protocol, but its implementation must include proper authentication and authorization from the design stage.

Dave Gerry, CEO of Bugcrowd, commented that “the discovery of RufRoot underscores the urgency of securing AI infrastructures, especially as companies integrate autonomous agents into critical workflows.”

Consequences and context

The flaw affects Ruflo versions prior to 3.16.3, which was released to fix the vulnerability. However, the pace of patch adoption in enterprise environments is often slow. Given that Ruflo is often deployed in containers and cloud environments, the risk of exposure is high. The research validated each stage of the attack chain against a default deployment on AWS EC2.

Beyond Ruflo, this case highlights a broader security challenge: AI orchestration protocols like MCP are being rapidly adopted without sufficient security scrutiny. As companies integrate autonomous agents into critical processes, the consequences of a hijack could be catastrophic, from data theft to sabotage of operations.

What should readers know?

If your organization uses Ruflo, you should immediately update to version 3.16.3 or later. Additionally, it is crucial to review network configuration to ensure that the MCP bridge is not exposed to the Internet without authentication. Security teams should actively monitor MCP endpoints for suspicious activity.

For developers working with MCP or other orchestration protocols, this incident underscores the need to implement authentication and authorization from day one. As Noma Security noted, “giving unauthenticated access to the MCP Bridge means giving unauthenticated access to everything.”

Security leaders should consider that the AI supply chain introduces new attack vectors. The persistent memory of agents can be poisoned, potentially corrupting future AI decisions without operators noticing.

“The MCP Bridge is not some random auxiliary interface; it is the central nervous system of Ruflo. Every tool call, every agent action, every memory operation passes through the MCP bridge. Giving unauthenticated access to the MCP bridge means giving unauthenticated access to everything.” — Noma Security

In summary, RufRoot is a wake-up call for the AI industry. The speed of innovation must not sacrifice security. Companies must adopt a security-by-design approach and apply critical patches with the same urgency as in any other enterprise software.