ruflo CVE-2026-59726: MCP bridge in the default docker-compose deployment ran tools, including terminal_execute, without authentication (GitHub advisory CVSS 10.0); fixed in 3.16.3, public exploit now listed on Exploit-DB
The ruflo maintainer's GitHub advisory GHSA-c4hm-4h84-2cf3 (published 1 July 2026, CVE-2026-59726) says the MCP bridge shipped in ruflo/docker-compose.yml exposed POST /mcp with no authentication, and the docker-compose defaults bound the bridge and MongoDB to all interfaces.
According to the advisory, an unauthenticated network attacker could invoke tools/call to terminal_execute inside the bridge container, obtain a shell as node (uid 1000), read every provider API key from the container environment, spawn swarms on the victim's keys, and persist a poisoned pattern in the AgentDB learning store.
The terminal_execute blocklist was enforced only in the autopilot flow; POST /mcp and POST /mcp/:group bypassed it. Affected: ruflo (npm) below 3.16.3; patched: 3.16.3.
The advisory rates it Critical, CVSS 3.1 10.0 (CWE-78, CWE-306, CWE-942), and credits Eli Ainhorn of Noma Security. (source: GitHub advisory) Exploit-DB listed 'Ruflo MCP Bridge 3.16.2 - Remote Code Execution' (EDB 52705) on 11 November 2026. (source: Exploit-DB)
- Product
- ruflo (npm) — MCP bridge in the default docker-compose deployment
- Versions
- Below 3.16.3; fixed in 3.16.3
- CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Exploited in Australia?
- unknown
- Patch to
- Upgrade ruflo to 3.16.3 or later. Per the advisory, operators of any exposed instance must firewall ports 3001 and 27017, rotate OpenAI, Google, OpenRouter and Anthropic keys, audit the AgentDB pattern store and purge injected patterns (a patched redeploy does not undo poisoning), and audit MongoDB for tampering.