Skip to content

Ruflo CVE-2026-59726 unauthenticated MCP bridge RCE

Summary

CVE-2026-59726 is a critical missing-authentication and command-execution vulnerability in Ruflo, an open-source multi-agent orchestration platform. Before 3.16.3, Ruflo's default Docker Compose deployment bound its MCP bridge and MongoDB to all interfaces. An unauthenticated network caller could invoke tools/call against ruflo__terminal_execute through POST /mcp or POST /mcp/:group and obtain a shell in the bridge container.

The reported impact extends beyond container command execution: provider API keys in environment variables, stored conversations, and AgentDB learning-store patterns were reachable. An attacker could use stolen model credentials, deploy a persistent payload under /app, or insert a poisoned pattern that influences later agent output. This is a publicly disclosed vulnerability and default-exposure path; the reviewed sources do not establish in-the-wild exploitation.

Tags

Exposure and impact

  • Affected range: Ruflo releases before 3.16.3 when the vulnerable MCP bridge is network reachable; default Docker Compose exposure is the reported path.
  • MCP endpoints: POST /mcp and POST /mcp/:group.
  • Sensitive tool: ruflo__terminal_execute through JSON-RPC tools/call.
  • Default listeners: MCP bridge TCP/3001 and MongoDB TCP/27017 were bound broadly in the vulnerable deployment configuration.
  • Credential impact: model-provider keys available to the bridge process can be read from its environment and used outside the victim deployment.
  • Data and integrity impact: stored conversations can be read, and attacker-authored agentdb_pattern-store entries can persistently steer later agent behavior.
  • Persistence: container filesystem writes under /app can survive the initial request until the workload is rebuilt or the modified storage is removed.

Fix characteristics

Ruflo 3.16.3 changed multiple boundaries rather than only filtering one request:

  • the MCP bridge binds to loopback by default;
  • terminal_execute is gated by server-side executeTool controls;
  • MongoDB authentication is enabled; and
  • the release hardens the default Compose deployment associated with GHSA-c4hm-4h84-2cf3.

Loopback binding is exposure reduction, not a substitute for tool authorization where untrusted local workloads, reverse proxies, tunnels, or shared hosts can reach the service.

Defender actions

  1. Upgrade to Ruflo 3.16.3 or later and verify the effective deployment configuration, not only the package version.
  2. Block external access to TCP/3001 and TCP/27017. Require authenticated, authorized access at the MCP tool-invocation boundary if the bridge must be reachable beyond localhost.
  3. Treat model-provider keys and any other secrets available to the bridge or MongoDB as compromised if the vulnerable service was exposed. Revoke and rotate them; inspect provider-side use for unfamiliar agents, models, source addresses, volume, and spend.
  4. Rebuild bridge containers from a trusted image. Compare persistent volumes and /app against known-good content rather than assuming restart removes attacker writes.
  5. Audit AgentDB for unfamiliar or modified agentdb_pattern-store entries and review stored conversations and MongoDB records for unauthorized reads or changes.
  6. Preserve reverse-proxy, firewall, container, process, MCP, MongoDB, provider, and AgentDB evidence before cleanup. Hunt for anonymous POST /mcp requests, tools/call, ruflo__terminal_execute, unexpected shell/interpreter children, secret reads, outbound connections, and newly written executable or startup content.
  7. Do not validate a production instance by invoking shell tools. Confirm listener scope and authorization through configuration review or a benign test deployment.

Sources