CVSS 10.0 in Ruflo's MCP Bridge: Unauthenticated RCE via Open Port (CVE-2026-59726)

Ruflo, an open-source agent platform for Claude Code and Codex with 66,500+ GitHub stars, exposed its entire MCP bridge — shell execution, database ops, AI memory — without authentication; a single unauthenticated HTTP POST was RCE. Patched in v3.16.3.

Noma Labs disclosed CVE-2026-59726 ("RufRoot") on July 29. Before version 3.16.3, Ruflo's default Docker Compose deployment bound its MCP bridge to all network interfaces on port 3001 with no authentication required. The bridge exposed 233 tools: shell command execution, database operations, agent management, and AgentDB memory storage — all accessible to anyone on the network with a single HTTP POST to /mcp.

The full exploit chain, documented by Noma:

1. POST /mcp → invoke terminal_execute tool → shell in the bridge container
2. Read /proc/env and config directories → harvest LLM provider API keys
3. Write to AgentDB → poison the agent's persistent memory and training examples

RCE without credentials on a production agent platform is CVSS 10.0. Ruflo's maintainer Reuven Cohen merged a fix (PR #2521) within 24 hours of the June 30 disclosure; v3.16.3 makes the bridge bind to localhost only and requires authentication before any tool call. A public GHSA advisory (GHSA-c4hm-4h84-2cf3) is live.

Why it matters: Any self-hosted MCP server that binds to 0.0.0.0 without auth has this attack surface. Review your own MCP deployments now: the bridge should listen on 127.0.0.1 only, and every tool-call endpoint should require a token or session credential. Default-open is never acceptable for an endpoint that exposes shell access.

Sources: RufRoot — Noma Security · Ruflo MCP Flaw — The Hacker News · CVSS 10.0 RufRoot — HackRead · Critical Ruflo MCP Bridge Flaw — GBHackers