A critical security vulnerability in the open-source Ruflo artificial intelligence platform could allow unauthenticated attackers to execute commands remotely, steal sensitive credentials, and manipulate AI memory systems.
Tracked as CVE-2026-59726 with the maximum CVSS severity rating of 10.0, the flaw affects all Ruflo versions released before 3.16.3. Security researchers have named the vulnerability RufRoot after discovering that exposed Model Context Protocol (MCP) services could provide attackers with complete control over vulnerable deployments.
Unprotected MCP Interface Exposed Dangerous Tools
Ruflo, originally developed as Claude Flow, is an AI orchestration framework designed to coordinate multiple AI agents, automate workflows, and build advanced conversational systems. The project has gained significant popularity among developers using AI-powered applications.
Researchers from Noma Security’s Noma Labs found that Ruflo exposed hundreds of internal tools through an unauthenticated MCP bridge. These tools included capabilities for:
- Running shell commands
- Managing AI agents
- Accessing databases
- Controlling memory storage systems
- Managing automated workflows
The vulnerability was caused by default deployment settings that exposed the MCP bridge to the network without requiring authentication.
Attackers Could Gain Full Control of AI Environments
According to researchers, attackers could exploit the flaw by sending a single malicious request to an exposed Ruflo instance. Successful exploitation could provide command execution inside the affected container.
Once access was obtained, attackers could potentially:
- Steal API keys used to connect with large language model providers
- Access stored user conversations
- Modify AI memory databases
- Alter future AI responses and behavior
- Deploy persistent malicious code
- Create unauthorized AI agent workflows
Security experts warned that compromising an AI system’s memory layer presents a unique risk because attackers may be able to influence future outputs even after the initial intrusion is removed.
AI Memory Poisoning Creates Long-Term Risks
One of the most serious aspects of the vulnerability is the ability to manipulate Ruflo’s persistent AI memory system.
Researchers said attackers could inject malicious instructions into the AgentDB learning store, allowing them to influence how AI agents behave during future interactions. This type of attack, known as AI memory poisoning, can create long-term security issues by modifying the information an AI system relies on.
Unlike traditional breaches that focus on stolen data, AI memory attacks can alter decision-making processes and affect users who interact with the compromised system later.
Developer Releases Security Patch
The vulnerability was responsibly disclosed to Ruflo’s maintainer on June 30, 2026. A security update was released shortly afterward in version 3.16.3.
The patch includes several security improvements, including:
- Binding the MCP bridge to the local interface by default
- Restricting access to command execution features
- Adding authentication protections
- Enabling MongoDB authentication to prevent unauthorized data access
The maintainers acknowledged that previous Docker Compose configurations exposed critical services to all network interfaces.
Organizations Urged to Take Immediate Action
Organizations running vulnerable Ruflo deployments should take additional steps beyond upgrading the software.
Security recommendations include:
- Closing unnecessary network access to ports 3001 and 27017
- Rotating all AI provider API keys
- Reviewing AI memory databases for unauthorized changes
- Checking logs for suspicious activity
- Rebuilding affected containers from trusted images
Researchers emphasized that updating the software alone may not remove all risks because attackers could have already accessed credentials or modified AI memory data.
Growing Security Concerns Around AI Infrastructure
The Ruflo vulnerability highlights increasing security challenges as organizations adopt AI agent platforms and autonomous workflows.
As AI systems gain access to sensitive data, external APIs, and persistent memory, security researchers warn that traditional application security practices must evolve to address new threats such as AI agent hijacking, memory manipulation, and unauthorized automation.
