Cybersecurity specialists have identified a critical vulnerability in Ruflo, a widely-used open-source orchestration platform for AI systems like Anthropic Claude Code and OpenAI Codex. This flaw, which has been assigned the identifier CVE-2026-59726 and carries a maximum CVSS score of 10.0, could lead to remote code execution without authentication.
Understanding the Vulnerability
Ruflo, initially known as Claude Flow, has become a significant tool for deploying and managing AI-driven workflows. However, a critical flaw has been discovered by Noma Security’s research division, Noma Labs, and labeled as RufRoot. This vulnerability affects all Ruflo versions prior to 3.16.3, allowing exposure through an unauthenticated Model Context Protocol (MCP) bridge.
The root of the issue lies in the default configuration of the “docker-compose.yml” file, which binds port 3001 to 0.0.0.0, making it accessible on all network interfaces. This exposure depends on the deployment’s network security settings, such as firewalls and security groups. Consequently, any network-accessible instance of Ruflo is at risk of complete exploitation without needing authentication.
Exploitation and Impact
Exploiting this flaw requires merely sending an unauthenticated HTTP POST request to port 3001, which allows attackers to execute arbitrary commands. Cybersecurity expert Eli Ainhorn demonstrated the simplicity of this attack with a crafted cURL command targeting Ruflo’s MCP bridge.
Once compromised, attackers can access Ruflo’s API keys, manipulate stored user interactions, and tamper with AI memory to alter model outputs. This vulnerability essentially opens the door to unauthorized access and manipulation of AI systems, leading to potential data theft and persistent malicious payloads.
Remedial Measures and Future Precautions
In response to the disclosed vulnerability on June 30, 2026, a patch was swiftly released by Ruflo’s maintainer, Reuven Cohen. This update ensures that the MCP bridge defaults to using the loopback interface, restricts command execution, and mandates MongoDB authentication to safeguard conversations.
Organizations operating exposed instances are urged to immediately secure their systems by closing firewall ports 3001 and 27017, rotating API keys, and auditing the AgentDB pattern store for unauthorized entries. Moreover, ensuring containers are built from clean images is crucial to mitigating further risks.
Noma Security highlights that the ability to alter an AI system’s persistent memory poses long-term risks, necessitating comprehensive audits and preventive measures. The incident underscores the importance of robust security practices in AI deployment to prevent unauthorized influences and data breaches.
