Intelligence
Join the waitlist
AEV-2026-0038

Ruflo's MCP bridge reached an unblocked terminal_execute and a writable AgentDB with no authentication (CVE-2026-59726)

Ruflo's default docker-compose deployment bound its MCP bridge and MongoDB to every network interface, and POST /mcp and POST /mcp/:group accepted a tools/call request with no credential check at all. A blocklist covering terminal_execute existed only inside a separate autopilot handler, so a direct, unauthenticated request reached terminal_execute unrestricted, gaining a shell that could read provider API keys and write into AgentDB, Ruflo's own persistent learning store. Formally assigned CVE-2026-59726 at CVSS 10.0, fixed in version 3.16.3, which closes both the network exposure and the enforcement gap; Ruflo's own release notes separately instruct operators to audit and purge AgentDB, stating the code fix does not undo that on its own.

AESS 8.5 highConfirmedStatus: resolvedEvent: 1 July 2026Execution AuthorityEnvironment BoundariesAgent IdentityAudit and Evidence

Affected

Organisation
ruvnet (Ruflo project)
Product
Ruflo
Component
MCP bridge POST /mcp and POST /mcp/:group handlers, reaching executeTool with no authentication and no shared terminal_execute gate
Versions
Every version before 3.16.3, confirmed at the commit immediately preceding remediation commit d00a0a40cd8bdbca877ac7f675f416bdc69accd1; fixed in 3.16.3
Configurations
Ruflo's default docker-compose deployment, which bound the MCP bridge, port 3001, and MongoDB, port 27017, to every network interface; MCP bridge reachable by a network caller with tool support, including terminal_execute, enabled

Execution authority facts

Fields the evidence does not establish are shown as unknown rather than guessed.

Intended task
An MCP caller invoking a tool through the bridge's POST /mcp or POST /mcp/:group endpoint
Agent
Ruflo's own MCP bridge process, through executeTool
Delegating actor
The operator who deploys Ruflo's default docker-compose configuration
Action
Invoked terminal_execute through executeTool with no authentication and no blocklist check on this path, gaining shell access inside the bridge container
Target resource
The bridge container's own shell, the provider API keys held as environment variables inside it, and AgentDB, Ruflo's persistent pattern and learning store, writable from inside that container
Environment
Wherever the operator runs Ruflo's default docker-compose deployment
Credentials used
None presented by the caller; the bridge process's own provider API keys, for OpenAI, Google, OpenRouter and Anthropic, became reachable once a shell was gained
Privileges available
The bridge container's own filesystem, process and network reach
Authority presented
A well formed tools/call request naming terminal_execute, with no credential of any kind
Authority required
Authorization for terminal command execution inside the bridge container
Applicable policy
isBlockedTool, a blocklist covering terminal_execute and other dangerous tool names, confirmed by this session to exist and work correctly, called only from Ruflo's autopilot request handler; not called from POST /mcp or POST /mcp/:group
Approval mechanism
none
Required approver
unknown
Independent approval
no
Action binding
No authorization bound to the executed action at all; the request's only stated intent was the tool name and arguments the caller supplied
Sequence context
The action executed on the caller's first request to either direct MCP endpoint, with no prior step in the bridge's own request handling that could have gated it

Impact

Consequence
Unauthenticated remote command execution inside the bridge container, confirmed provider API key exposure for four LLM providers, and write access to AgentDB sufficient to persist an attacker authored pattern into the project's own learning store
Reach
organisational
Reversibility
Recoverable with effort: the network and enforcement gaps are closed by a code fix, provider keys can be rotated, and Ruflo's own guidance describes a manual audit and purge path for AgentDB, though nothing in the evidence available to this entry establishes that path as guaranteed to find every injected entry
Detectability
unknown
Propagation
A concrete propagation path exists directly in Ruflo's own advisory and release notes, an injected AgentDB pattern read back by future, legitimate agent activity as trusted input, but this entry has no evidence that propagation was observed operating against a real deployment beyond the disclosed mechanism itself
Recovery
Fixed in version 3.16.3, merged in pull request 2521 the same day as the advisory: default loopback bind, a fail closed public bind requiring MCP_AUTH_TOKEN, constant time Bearer authentication, a terminal_execute gate moved into executeTool itself and required opt in through MCP_ENABLE_TERMINAL, MongoDB authentication with a mandatory root password, a read only bridge filesystem, and a CORS allowlist. This session found no evidence of the fix being reverted or weakened through the current release, v3.38.21. Separately, and not accomplished by the code fix, Ruflo's own release notes instruct operators to rotate every provider key and to audit and manually purge AgentDB for injected pattern store entries.

Evidence

Primary sources

Supporting sources

Reproduction status
Vendor disclosed and patched the same day. This session independently read the affected source directly at the commit immediately before remediation, confirming both the absent authentication on the two direct MCP endpoints and the exact call site of isBlockedTool inside the autopilot handler alone, rather than relying on the advisory's own prose description of the mechanism.
Evidence state
Confirmed

Known unknowns

  • Whether this vulnerability was exploited against a real, network reachable Ruflo deployment before the researcher's disclosure.
  • What share of Ruflo deployments ran the default docker-compose configuration exposed to a reachable network, as opposed to a custom deployment already isolating those ports.
  • Whether any specific AgentDB instance was in fact poisoned, as distinct from the write access this entry confirms existed.
  • Whether an operator following Ruflo's own audit and purge guidance can reliably find every injected pattern store entry, as opposed to the obviously named or recently written ones.
  • The exact CVE Program record's own wording for CVE-2026-59726, since cve.org was blocked to direct fetch in this session and this entry relies on GitHub's Security Advisory Database record instead.

Limitations

  • This session's direct fetch of the CVE Program's own record at cve.org, and of nvd.nist.gov and osv.dev, was blocked by this session's network egress policy; CVE publication chronology beyond the GHSA's own 1 July 2026 date rests on independently reported secondary coverage rather than a direct read of the Program's own record.
  • thehackernews.com, securityweek.com, csoonline.com, cybersecuritynews.com and noma.security were all blocked to direct fetch in this session; this entry cites two of them at the level of a search result title only, for independent confirmation that the vulnerability received contemporaneous press coverage, and rests no specific factual claim on their content.

Claim provenance

  • verified
    GitHub's Security Advisory Database, read directly, assigns CVE-2026-59726, rates it a maximum CVSS 4.0 base score of 10.0 Critical, and classifies it under CWE-78, CWE-306 and CWE-942, against ruflo, every version before 3.16.3, credited to researcher Eli Ainhorn of Noma Security and reviewed by Dragan Spiridonov.
    They Patched the MCP Bridge. The Attacker's Instructions Could Still Be in the Agent's Memory.
  • verified
    This session read the affected source directly at the commit immediately before remediation, confirming POST /mcp and POST /mcp/:group carried no authentication check and routed a request directly into executeTool, and confirming isBlockedTool, which correctly matched a terminal_execute pattern, was called exclusively from Ruflo's autopilot request handler and nowhere on either direct MCP endpoint's own path.
    They Patched the MCP Bridge. The Attacker's Instructions Could Still Be in the Agent's Memory.
  • verified
    This session read the remediation commit's diff directly, confirming a new requireAuth middleware using constant time comparison, a terminal_execute gate moved into executeTool and required opt in through MCP_ENABLE_TERMINAL, a default loopback bind failing closed on public exposure without MCP_AUTH_TOKEN, and a CORS allowlist. The commit's own message additionally states that the network fix alone, without also addressing AgentDB pattern store poisoning, would have left the learning store compromise unaddressed.
    They Patched the MCP Bridge. The Attacker's Instructions Could Still Be in the Agent's Memory.
  • verified
    The merged pull request's own description, read directly, states that the sole call site of isBlockedTool before this change was the autopilot handler, that the two direct MCP endpoints were unprotected, and that the fix centralizes the gate inside executeTool so every path shares one denial gate.
    They Patched the MCP Bridge. The Attacker's Instructions Could Still Be in the Agent's Memory.
  • verified
    Ruflo's own release notes, read directly, list the shipped security fixes and separately instruct operators to firewall the exposed ports, rotate provider API keys for OpenAI, Google, OpenRouter and Anthropic, audit and purge the AgentDB pattern store, and review MongoDB for unauthorized modification, stating these as distinct required actions alongside the version upgrade.
    They Patched the MCP Bridge. The Attacker's Instructions Could Still Be in the Agent's Memory.
  • verified
    This session reviewed release notes from 3.16.3 through the most recent tagged release at the time of this entry, v3.38.21, and found no description of a reversion, weakening or further change to the loopback bind default, the MCP_AUTH_TOKEN requirement, the terminal execution gate, or MongoDB authentication.
    They Patched the MCP Bridge. The Attacker's Instructions Could Still Be in the Agent's Memory.