Ruflo's default MCP bridge exposed unauthenticated shell execution and agent memory poisoning

Reconstruction

Ruflo's vulnerable boundary was the MCP control plane around the agents, not a language-model behavior. The shipping Docker Compose configuration exposed the MCP bridge and MongoDB on all interfaces, while POST /mcp accepted tool calls without an authentication gate. The bridge also exposed terminal_execute, and the tool blocklist that mentioned that capability applied only to the autopilot flow rather than to the direct MCP routes.

That produced a direct network-to-tool path. Ruflo's advisory says an unauthenticated caller could invoke terminal execution, obtain a shell as the container user, read provider API keys inherited by the bridge, spawn attacker-controlled swarms on those credentials and write poisoned patterns into AgentDB. MongoDB exposure and persistent learning state widened the effect beyond one shell session.

The evidence has an important provenance boundary. The coordinated-disclosure report included an eight-step proof of concept and video described as live against a default AWS EC2 deployment. Ruflo's maintainers did not perform live exploitation; they statically verified the report against the checked-out source, reviewed the proof of concept and shipped a layered remediation that changed default binding, authentication, terminal-tool gating, MongoDB authentication and container hardening.

Mechanism & boundary

1. 01

   Reach the shipping MCP bridge

   The default Docker Compose topology bound the bridge to port 3001 on all interfaces; MongoDB on 27017 was also publicly bound by default.

   Boundary: network / agent control plane

2. 02

   Call the MCP route without authentication

   POST /mcp accepted tool calls without proving caller identity.

   Boundary: remote request / MCP tool dispatcher

3. 03

   Bypass the flow-specific tool blocklist

   The terminal_execute blocklist was enforced in the autopilot path, while direct POST /mcp and /mcp/:group calls bypassed that policy.

   Boundary: tool policy / direct API path

4. 04

   Obtain code execution in the bridge container

   The advisory states that terminal_execute provided shell execution as the node user inside the bridge container.

   Boundary: MCP tool / runtime container

5. 05

   Reach credentials and persistent agent state

   The compromised bridge inherited provider credentials and could reach AgentDB and MongoDB, creating paths to credential abuse, persistent poisoned learning state and conversation-store tampering.

   Boundary: runtime container / provider keys and persistent stores

Timeline

1. Jun 30, 2026

   Ruflo receives the coordinated disclosure

   report

   ADR-166 says the report included an eight-step proof of concept and video described as confirmed against a default AWS EC2 deployment.

2. Jun 30, 2026

   Maintainers complete static verification and ship remediation phases 0-3

   mitigation

   ADR-166 records static verification of the substantive claims and layered changes to binding, authentication, tool gating, MongoDB and runtime defaults.

3. Jul 1, 2026

   Ruflo publishes the GitHub security advisory

   publication

   GHSA-c4hm-4h84-2cf3 identifies versions before 3.16.3 as affected, 3.16.3 as patched and assigns CVE-2026-59726.

Claims & evidence

Implications

An MCP bridge is a privileged control plane, not harmless glue between a model and tools. If network identity, tool authorization and persistent state protection fail at that layer, an attacker can bypass model-level safeguards entirely. Remediation also has an incident-response dimension: once credentials or learned state may have been changed, fixing the route does not restore the prior trust state.

Controls & mitigations

• Upgrade Ruflo to 3.16.3 or later.
• Bind MCP control planes to loopback by default and fail closed if an operator requests public binding without an authentication token.
• Authenticate and authorize every MCP route at a common boundary so direct API paths cannot bypass flow-specific policy.
• Keep terminal execution disabled unless explicitly enabled and enforce that decision inside the common tool dispatcher.
• Require authentication for MongoDB and avoid publishing bridge/database ports to all interfaces by default.
• Use container hardening such as read-only filesystems and temporary writable mounts where compatible with the workload.
• For any instance that was exposed before remediation, firewall the affected ports, rotate provider credentials, review provider billing, audit AgentDB and MongoDB, and purge poisoned persistent state rather than relying on redeployment alone.

What remains unknown

• The reviewed sources do not establish malicious exploitation of third-party Ruflo deployments in the wild.
• Ruflo's maintainers did not measure how many live deployments used the vulnerable default exposure.
• The maintainers did not independently execute the disclosed proof of concept; their verification was static plus review of the researcher's materials.
• The downstream effect of poisoned AgentDB state depends on how a deployment consumes learned patterns and whether operators audited persistent state after patching.

Connected research