DIGGINGBEAGLE

Case · DiggingBeagle record

Ruflo's default MCP bridge exposed unauthenticated shell execution and agent memory poisoning

Ruflo's default Docker deployment exposed an MCP bridge without authentication. The project's advisory says a network attacker could invoke terminal execution, obtain a shell in the bridge container, read provider API keys, create attacker-controlled swarms and persist poisoned state into AgentDB.

MCP control-plane exposureAgent authority
Scope

Defensive coordinated vulnerability disclosure affecting Ruflo before 3.16.3. The researcher-provided proof of concept was described to maintainers as confirmed against a default AWS EC2 deployment; Ruflo's ADR independently verified the substantive claims through static source analysis and review of the disclosed proof of concept but did not re-run it against a live host. The scoped record does not establish malicious exploitation of third-party deployments.

Assessment profile

Assessment method
Setting
research demonstration
Exploitation
demonstrated
Evidence
Grade B
Remediation
patch available
AI role
AGAINST AI
Basis and provenance

The maintainer advisory and ADR describe a researcher-supplied live PoC but static maintainer verification. A named patch and persistent-state response guidance support patch availability, not independent live fix verification or evidence of attacks on victims. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded.

Assessed Sep 24, 2026 using diggingbeagle.assessment/1.

Evidence basis: CLM-RUFROOT-DEFAULT-RCE · CLM-RUFROOT-POC-PROVENANCE · CLM-RUFROOT-FIX · CLM-RUFROOT-INCIDENT-RESPONSE · ADR-166: MCP bridge unauthenticated RCE remediation · Unauthenticated RCE in ruflo MCP bridge default docker-compose deployment

At a glance

Mechanism and trust boundary

  1. 01

    Reach the shipping MCP bridge

    The default Docker Compose topology bound the bridge to port 3001 on all interfaces; MongoDB on 27017 was also publicly bound by default.

    Boundary: network / agent control plane

  2. 02

    Call the MCP route without authentication

    POST /mcp accepted tool calls without proving caller identity.

    Boundary: remote request / MCP tool dispatcher

  3. 03

    Bypass the flow-specific tool blocklist

    The terminal_execute blocklist was enforced in the autopilot path, while direct POST /mcp and /mcp/:group calls bypassed that policy.

    Boundary: tool policy / direct API path

  4. 04

    Obtain code execution in the bridge container

    The advisory states that terminal_execute provided shell execution as the node user inside the bridge container.

    Boundary: MCP tool / runtime container

  5. 05

    Reach credentials and persistent agent state

    The compromised bridge inherited provider credentials and could reach AgentDB and MongoDB, creating paths to credential abuse, persistent poisoned learning state and conversation-store tampering.

    Boundary: runtime container / provider keys and persistent stores

Timeline

  1. Jun 30, 2026
    Event type unspecified

    Ruflo receives the coordinated disclosure

    ADR-166 says the report included an eight-step proof of concept and video described as confirmed against a default AWS EC2 deployment.

  2. Jun 30, 2026
    mitigation

    Maintainers complete static verification and ship remediation phases 0-3

    ADR-166 records static verification of the substantive claims and layered changes to binding, authentication, tool gating, MongoDB and runtime defaults.

  3. Jul 1, 2026
    Event type unspecified

    Ruflo publishes the GitHub security advisory

    GHSA-c4hm-4h84-2cf3 identifies versions before 3.16.3 as affected, 3.16.3 as patched and assigns CVE-2026-59726.

Claims & evidence

CLM-RUFROOT-FIXThe Ruflo GitHub advisory identifies versions before 3.16.3 as affected and 3.16.3 as patched.supported

Basis: reported finding

Link to claim
CLM-RUFROOT-SEVERITYThe Ruflo GitHub advisory tracks the issue as CVE-2026-59726, assigns CVSS 10.0 under v3.1 and lists CWE-78, CWE-306 and CWE-942.supported

Basis: reported finding

Scope: Severity measurement for the vulnerability; it is not a measure of observed victim count.

Recorded measurement: 10 CVSS v3.1 base score · Ruflo GHSA vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Link to claim
CLM-RUFROOT-DEFAULT-RCERuflo's shipping Docker Compose deployment exposed the MCP bridge without authentication, and the advisory states that an unauthenticated caller could invoke terminal_execute through the MCP tool path and obtain code execution inside the bridge container.supported

Basis: reported finding

Link to claim
CLM-RUFROOT-POC-PROVENANCEADR-166 says the coordinated-disclosure package contained an eight-step proof of concept and video described as confirmed against a default AWS EC2 deployment, while Ruflo's maintainers verified the claims statically and did not re-run the exploit.supported

Basis: reported finding

Scope: The live-AWS statement is the researcher's reported proof-of-concept result as relayed by Ruflo; the maintainers' own verification was static.

Link to claim
CLM-RUFROOT-SECRETS-MEMORYThe Ruflo advisory states that successful exploitation could expose provider API keys, allow attacker-controlled swarms to run on victim credentials and persist poisoned patterns into the AgentDB learning store.supported

Basis: reported finding

Link to claim
CLM-RUFROOT-INCIDENT-RESPONSERuflo advises operators of exposed instances to firewall ports 3001 and 27017, rotate provider keys, audit AgentDB for poisoned patterns and audit MongoDB; the advisory warns that redeploying a patched image does not by itself remove poisoned state.supported

Basis: reported finding

Link to claim
CLM-RUFROOT-MAINTAINER-VERIFYRuflo's ADR-166 says the maintainers statically verified every substantive coordinated-disclosure claim against the checked-out source and characterized the default deployment as an internet-reachable unauthenticated RCE.supported

Basis: reported finding

Link to claim

Implications

An MCP bridge is a privileged control plane, not harmless glue between a model and tools. If network identity, tool authorization and persistent state protection fail at that layer, an attacker can bypass model-level safeguards entirely. Remediation also has an incident-response dimension: once credentials or learned state may have been changed, fixing the route does not restore the prior trust state.

Controls and mitigations

  • Upgrade Ruflo to 3.16.3 or later.
  • Bind MCP control planes to loopback by default and fail closed if an operator requests public binding without an authentication token.
  • Authenticate and authorize every MCP route at a common boundary so direct API paths cannot bypass flow-specific policy.
  • Keep terminal execution disabled unless explicitly enabled and enforce that decision inside the common tool dispatcher.
  • Require authentication for MongoDB and avoid publishing bridge/database ports to all interfaces by default.
  • Use container hardening such as read-only filesystems and temporary writable mounts where compatible with the workload.
  • For any instance that was exposed before remediation, firewall the affected ports, rotate provider credentials, review provider billing, audit AgentDB and MongoDB, and purge poisoned persistent state rather than relying on redeployment alone.

Unknowns and contradictions

  • The reviewed sources do not establish malicious exploitation of third-party Ruflo deployments in the wild.
  • Ruflo's maintainers did not measure how many live deployments used the vulnerable default exposure.
  • The maintainers did not independently execute the disclosed proof of concept; their verification was static plus review of the researcher's materials.
  • The downstream effect of poisoned AgentDB state depends on how a deployment consumes learned patterns and whether operators audited persistent state after patching.

Sources and citation

EvidenceUnauthenticated RCE in ruflo MCP bridge default docker-compose deploymentEvidenceADR-166: MCP bridge unauthenticated RCE remediation

Material revision history

  1. Sep 19, 2026 · Published version · first publication · revision 22
  2. Sep 25, 2026 · Published version · material revision · revision 39Public fields changed: assessment_profile
Record metadata

Canonical ID: CASE-2026-RUFROOT-RUFLO-MCP-RCE · revision 39

Legacy date (semantics unspecified): 2026-07-01. This value is not treated as an occurrence or disclosure date.