Evidence · DiggingBeagle record
ADR-166: MCP bridge unauthenticated RCE remediation
Ruflo maintainer remediation document stating that the project statically verified the coordinated-disclosure claims against the shipping default deployment and describing the security redesign.
- Published
- Jun 30, 2026
- Accessed
- Sep 19, 2026
- Publisher
- ruflo
- Source role
- vendor remediation adr
- Version
- ADR-166
Evidence record
We statically verified every substantive claim against the checked-out source.
Claim-level citations (3)
- supportsRuflo's default MCP bridge exposed unauthenticated shell execution and agent memory poisoning: Ruflo's shipping Docker Compose deployment exposed the MCP bridge without authentication, and the advisory states that an unauthenticated caller could invoke terminal_execute through the MCP tool path and obtain code execution inside the bridge container.
Context section stating the default deployment exposed an unauthenticated MCP bridge and that the report was statically verified
- supportsRuflo's default MCP bridge exposed unauthenticated shell execution and agent memory poisoning: ADR-166 says the coordinated-disclosure package contained an eight-step proof of concept and video described as confirmed against a default AWS EC2 deployment, while Ruflo's maintainers verified the claims statically and did not re-run the exploit.
ADR-166 sections 1.1 and 1.3: coordinated disclosure, reported AWS EC2 PoC and audit limitations
- supportsRuflo's default MCP bridge exposed unauthenticated shell execution and agent memory poisoning: Ruflo's ADR-166 says the maintainers statically verified every substantive coordinated-disclosure claim against the checked-out source and characterized the default deployment as an internet-reachable unauthenticated RCE.
Section 1.1 'Why this ADR now'