Artificial Intelligence Critical Ruflo Flaw Lets Attackers Spawn Rogue AI Swarms Unauthenticated attackers could send HTTP requests to an exposed endpoint to execute commands inside the MCP bridge container. By Ionut Arghire | July 30, 2026 (5:56 AM ET) Flipboard Reddit Whatsapp Whatsapp Email Unauthenticated attackers could exploit a critical-severity vulnerability in the open source AI agent orchestration platform Ruflo to execute commands inside the container, Noma Labs security researchers warn. A popular automation assistant with over 67,000 GitHub stars, Ruflo (formerly Claude Flow) comes with a multi-model AI chat interface, agent swarms, persistent memory, and built-in Model Context Protocol (MCP) tool calling. Ruflo allows organizations to use AI applications, courtesy of agent swarms (support for coordinating up to 100 agents on shared enterprise-grade tasks), long-term memory enabling agents to recall past interactions, and an integrated MCP server enabling agents to execute various tasks. “The bridge exposes 233 tools covering shell access, database operations, agent management, and memory storage, making it the single point through which every agent action flows. Because the MCP Bridge requires direct access to the underlying system resources to execute these commands, it creates a high-stakes security boundary,” Noma explains. Tracked as CVE-2026-59726 (CVSS score of 10/10), the security defect was found in the MCP bridge in ruflo/docker-compose.yml, which exposed the POST /mcp endpoint without authentication. Because in default docker-compose deployments the bridge and MongoDB were bound to all interfaces, an unauthenticated attacker could invoke terminal_execute to run commands inside the bridge container, Ruflo’s advisory reads. Advertisement. Scroll to continue reading. Successful exploitation of the bug could allow the attacker to gain shell access as node, read provider API keys, spawn swarms on the victim’s keys, and inject poison patterns into the AgentDB learning store to tamper with the AI outputs for all users. According to Noma, which named the bug RufRoot , the root cause is that, in self-hosted deployments, the docker-compose.yml binds port 3001 to 0.0.0.0 by default, exposing all network-reachable instances to exploitation without authentication. “The MCP Bridge isn’t a random auxiliary debug interface; rather, it is Ruflo’s central nervous system. Every tool call, every agent action, every memory operation goes through the MCP Bridge. Mistakenly giving unauthenticated access to the MCP Bridge means giving unauthenticated access to everything,” Noma explains. With a single HTTP request targeting ruflo__terminal_execute, an attacker could take over the agent swarm, because the command would run as the container’s node user, providing access to all accessible assets without further escalation. “Once you have command execution, achieving full compromise is just chaining more requests to the same endpoint,” Noma explains. An attacker could exploit the vulnerability for reconnaissance, remote code execution (RCE), API key and conversation theft, spawning attacker-controlled agent swarms, poisoning the learning pipeline to produce attacker-influenced output, deploying persistent backdoors, and clearing shell history to remove traces. The vulnerability was patched in Ruflo version 3.16.3. The fix addresses all attack vectors, and Ruflo’s maintainers published remediation steps for users with exposed instances. Related: Chrome 151 Patches 370 Vulnerabilities Related: Cisco Secure FMC Zero-Day Exploited in the Wild Related: JFrog Zero-Days Exploited in OpenAI-Hugging Face Hack Related: Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire US, Australia Release OT Isolation Guidance for Critical Infrastructure Spur Raises $200 Million for IP Intelligence Platform JFrog Zero-Days Exploited in OpenAI-Hugging Face Hack ShinyHunters Claims Ernst & Young Hack OT Security Startup Frenos Raises $1.52 Million Hush Security Raises $30 Million for AI Agent Governance Google Adopts New Threat Actor Naming System Unpatched Fastjson Vulnerability Exploited in Attacks Latest News 1 in 5 Data Center Assets Are Within Easy Reach of Attackers US and Allies Update SBOM Guidance Chrome 151 Patches 370 Vulnerabilities Cisco Secure FMC Zero-Day Exploited in the Wild US Bans Foreign-Made Humanoid Robots, Targeting China Over National Security Mate Security Raises $35 Million for Agentic SOC ThreatLocker Raises $190 Million in Series F Funding Critical VM Escape Vulnerability Patched in VMware ESXi Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Closing the Exploitation Gap July 22, 2026 Join this live webinar as we explore why exploitation is outpacing remediation, where risk is growing fastest, and what security leaders can do to close the gap before attackers take advantage. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the Move Alex Levinson has been named Executive Director at the National Collegiate Cyber Defense Competition. Hack The Box has appointed Konstantinos Dolkas as CTO and has promoted Christine Bartlett to CMO. The Department of Energy has appointed Andrew McClure as Director of the Office of Cybersecurity, Energy Security, and Emergency Response (CESER). More People On The Move Expert Insights Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) The Shift Toward Business-Aligned Risk Management Moving from isolated, technical data to a continuous risk lifecycle can help organizations align security controls with actual business consequences. (Steve Durbin) How to Conduct a Successful Audit of AI-Driven Software Development As AI-generated code becomes commonplace, CISOs need new audit strategies to measure developer practices, govern AI tool usage, and identify software risks before they reach production. (Matias Madou) Flipboard Reddit Whatsapp Whatsapp Email