Critical 'RufRoot' Flaw Grants Total Control Over Ruflo AI Agents

A critical security vulnerability dubbed 'RufRoot' has been discovered in Ruflo, an open-source AI agent orchestration platform, allowing remote attackers to hijack AI agents and execute arbitrary code. The flaw, tracked as CVE-2026-59726, carries a maximum CVSS score of 10.0, indicating the highest possible level of severity.

Discovered by Noma Security, the vulnerability affects all versions of Ruflo prior to 3.16.3. The issue stems from an unauthenticated Model Context Protocol (MCP) bridge—an Express.js server—that is exposed to the network by default. This bridge provides access to 233 different tools, including database operations and shell access via the 'ruflo__terminal_execute' function. Because the bridge lacks default authentication, attackers can execute a single HTTP request to steal LLM API keys, hijack agents, or gain full control of the host infrastructure. Noma Security researchers noted that giving unauthenticated access to the MCP Bridge is equivalent to giving unauthenticated access to everything.

The Rise of Agentic Risk

Ruflo is designed to coordinate multi-agent 'swarms' and integrate long-term memory for tools such as Claude Code. With over 67,000 GitHub stars, approximately 1 million active users, and 10 million downloads, the platform's wide adoption increases the potential attack surface. The vulnerability highlights a systemic trend where AI orchestration tools prioritize rapid deployment and ease of setup over 'secure by default' configurations, often leaving critical management interfaces exposed to corporate networks.

Systemic Implications

This flaw underscores the inherent risks of 'agentic' AI systems that possess direct access to system resources like shells and databases. Because the MCP bridge serves as the central nervous system for these agents, it represents a single point of failure. Beyond immediate code execution, attackers can perform 'AI memory poisoning' by inserting malicious entries into the AgentDB pattern store. This allows an attacker to influence future AI responses and maintain persistence within the environment even after the software has been patched.

The Path Forward

As AI adoption accelerates, security defaults are struggling to keep pace. Amit Jena, an AI Development Manager at Kanerika, stated that MCP adoption has outpaced the security defaults built into many orchestration tools. Users are urged to update to version 3.16.3 immediately to close the bridge. Security teams should also audit their AgentDB stores for signs of memory poisoning, as patching the software does not automatically remove malicious entries already inserted into the AI's long-term memory.