Ruflo's CVSS 10.0 MCP Bridge Flaw Is a Wake-Up Call for AI Coding Tool Security

TL;DR

A maximum-severity vulnerability (CVSS 10.0) in Ruflo — an open-source AI agent harness that wraps Claude Code and Codex — let anyone on the internet run arbitrary commands through an unauthenticated MCP bridge on port 3001. The fix shipped in 24 hours. But patching isn't enough: stolen API keys don't un-steal themselves, and AI memory poisoning survives version bumps. If you run any AI agent infrastructure with MCP bridges, audit them now.

What Happened

On June 30, 2026, Noma Labs disclosed CVE-2026-59726 — nicknamed "RufRoot" — in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex. At the time of disclosure, Ruflo had over 67,000 GitHub stars and ranked #2 on MCPMarket.

The vulnerability was dead simple. Ruflo's default docker-compose.yml exposed the MCP bridge on port 3001 with no authentication whatsoever. The POST /mcp endpoint accepted requests from anyone. Among the 233 exposed tools was terminal_execute. One unauthenticated HTTP POST — literally one request — gave an attacker a shell inside the bridge container.

From that shell, an attacker could do several things at once:

• Read every stored LLM API key — OpenAI, Anthropic, Google, whatever providers were configured
• Access and dump entire conversation histories between developers and their AI agents
• Inject poisoned patterns into Ruflo's AgentDB, a persistent learning store where agents record behavior patterns
• Launch rogue AI agent swarms under the attacker's control

The project maintainer, Reuven Cohen, shipped a fix in version 3.16.3 within 24 hours of the disclosure. The patch binds the MCP bridge to the loopback interface by default, adds server-side executeTool controls, and enables MongoDB authentication to block conversation theft.

Why Patching Isn't Enough

Most CVEs follow a simple script: patch the software, rotate creds, move on. RufRoot doesn't work that way. Two things make it unusually sticky.

First, AI memory poisoning is persistent. Ruflo's AgentDB stores patterns that agents use to improve future decisions — which tools to call, how to respond, what context matters. If an attacker injected poisoned patterns before you patched, those patterns stay in your database after the upgrade. Your agent might start recommending a malicious npm package, skipping a security check, or sending data to an external domain. You wouldn't notice until the damage is done, because the agent's behavior degrades slowly, not all at once.

Second, stolen credentials are forever. If your OpenAI or Anthropic API keys were exfiltrated during the window of exposure — and the vulnerability makes that trivially easy — upgrading to v3.16.3 doesn't invalidate them. The attacker still has working keys.

Noma Labs' remediation guidance reflects this: treat all AI provider credentials as compromised, rotate every key, audit AgentDB for signs of tampering, and rebuild containers from a clean image. Not just patch. Rebuild.

Why This Matters Beyond Ruflo

The RufRoot vulnerability isn't only about one open-source project. It exposes a pattern that's spreading through the AI coding tool ecosystem faster than security practices are catching up.

MCP — Model Context Protocol — has become the universal connector for AI coding agents. Claude Code uses it. Codex uses it. Cursor and GitHub Copilot support it. The protocol lets agents call tools, read files, run commands, and interact with external services through a standardized bridge.

The problem: most MCP bridges in the wild were built for convenience, not security. Developers run them on localhost and assume that's sufficient. It often isn't. In Docker Compose setups, CI/CD pipelines, and cloud VM deployments, a port bound to 0.0.0.0 or reachable through container networking is an open door. Ruflo's default config bound to all interfaces. One search on Shodan would find you.

The attack surface isn't theoretical. Every MCP bridge that exposes tool-calling endpoints without authentication is a command execution endpoint waiting to be found. The Ruflo incident just happens to be the highest-profile one that got caught first.

What You Should Do

I've talked to developers who assume "I'm not running Ruflo, so I'm fine." You might be, but the MCP bridge pattern is the real risk. Here's what to check:

Audit every MCP bridge you're running. Not just Ruflo. Check your Claude Code MCP configuration, your Codex integrations, your Cursor setups. Any bridge that accepts connections without authentication needs to be fixed or firewalled.

Rotate all your API keys. If you ran Ruflo before July 1, 2026, assume every LLM API key configured in it was stolen. Rotate them all — OpenAI, Anthropic, Google, any provider you connected.

Audit your agent memory stores. If you used AgentDB or any persistent agent memory in Ruflo, review recent entries for anything suspicious. Look for injected prompts, unusual tool-calling sequences, or references to unfamiliar domains.

Rebuild containers from scratch. A version bump inside a compromised container is not a clean state. Build from a clean image and redeploy.

Treat MCP bridges like database ports. Going forward, every MCP bridge in your deployment should default to authenticated, localhost-only, behind a firewall — the same way you'd treat a database port. "It's just a dev tool" stopped being a valid excuse the moment these bridges started holding API keys and executing commands.

The Bottom Line

RufRoot is the kind of vulnerability that was inevitable. We took a protocol designed for local tool calling, bolted it onto internet-connected infrastructure, and assumed the defaults would hold. They didn't.

MCP bridges are command execution endpoints. The next vulnerability in this category is a matter of when, not if. The question is whether your bridge will be the one that gets hit — and whether you've done enough to make that hit expensive instead of catastrophic.