RufRoot (CVE-2026-59726): CVSS 10.0 unauthenticated RCE in Ruflo's MCP bridge exposed 233 tools with no auth

Noma Security·high signalXBlueskyLinkedInCopy link

Noma Labs disclosed a maximum-severity flaw in Ruflo, an open-source agent orchestration meta-harness for Claude Code and Codex with 66,500+ GitHub stars, where the built-in MCP Bridge exposed 233 tools — including terminal_execute — over an unauthenticated HTTP endpoint on port 3001, bound to 0.0.0.0 by default in the shipped docker-compose. A single POST to /mcp yields shell access inside the container, from which an attacker can read provider API keys, harvest conversations, and poison AgentDB learning-store patterns; a command blocklist existed but applied only to the autopilot flow, not the /mcp endpoint. Disclosed June 30 and patched in 3.16.3 within 24 hours, the fix binds the bridge to loopback by default, adds bearer auth with constant-time comparison, and gates terminal_execute behind a flag.