All posts
Unproven Execution

RufRoot: Ruflo's MCP Bridge Unproven Execution

Ruflo's default docker-compose exposed an MCP Bridge with 233 tools including terminal_execute to the network with no authentication

Securityv0 Intelligence Team OWASP: ASI05 sv0 finding: unproven_execution
ruflo mcp unproven-execution cve-2026-59726 agent-orchestration authority-model

The Incident

On 2026-07-29, Noma Labs publicly disclosed CVE-2026-59726 — tracked as “RufRoot” and assigned CVSS 10.0 per GHSA-c4hm-4h84-2cf3 — in Ruflo, the open-source multi-agent orchestration meta-harness for Anthropic Claude Code and OpenAI Codex maintained by Reuven Cohen (formerly published as “Claude Flow”). Every Ruflo release prior to 3.16.3 shipped a default docker-compose.yml that bound the platform’s MCP Bridge — an Express.js server exposing 233 registered tools — to 0.0.0.0:3001 with no authentication, and the backing MongoDB store to 0.0.0.0:27017 with no credentials required. A single unauthenticated POST /mcp or POST /mcp/:group request from anywhere network-reachable was sufficient to invoke tools/call → terminal_execute, drop a shell inside the Bridge container, read Anthropic, OpenAI, Google, and OpenRouter provider API keys from the container environment, hijack running agents, spawn arbitrary new agent swarms, and write persistent malicious entries into the AgentDB pattern-store — the platform’s shared long-term memory that every future agent, on every future task, will read from.

Noma Security’s Eli Ainhorn (Senior AI Vulnerability Researcher) disclosed to Cohen on 2026-06-30. A fix shipped in Ruflo 3.16.3 within twenty-four hours; public disclosure was coordinated for 2026-07-29. GHSA-c4hm-4h84-2cf3 cites CWE-78 (OS Command Injection), CWE-306 (Missing Authentication for Critical Function), and CWE-942 (Permissive Cross-Domain Policy) — three weaknesses concentrated in one Express endpoint that the deploying operator was never asked to consent to publishing.

MITRE ATT&CK coverage: T1190 — Exploit Public-Facing Application — for the unauthenticated POST /mcp reach; T1059 — Command and Scripting Interpreter — for the terminal_execute invocation; T1528 — Steal Application Access Token — for the LLM provider keys held in the Bridge container’s environment; and T1565.001 — Data Manipulation: Stored Data Manipulation — for the AgentDB pattern-store writes that survive Bridge restart and steer every future agent decision.

The Authority Path That Failed

The identity that carried execution authority at the moment of failure is the MCP Bridge process itself, running as the container node user inside the documented Ruflo Docker deployment. Its held scope was the union of everything the Bridge could do on behalf of the platform operator: shell execution via the terminal_execute tool, read and write on the AgentDB pattern-store that every agent on the platform shares as long-term memory, read and write on the MongoDB store that holds agent definitions and conversation history, tools for spawning and managing agent swarms, and the environment variables carrying four LLM provider API keys. The scope it exercised — by construction of the endpoint — was whatever any anonymous HTTP caller asked, because POST /mcp and POST /mcp/:group shipped with no bearer check, no header check, no IP allowlist, and — per GHSA — a permissive CORS policy on top.

The trust anchor that failed first was the deployment-time defaults. A Ruflo operator who ran the documented “getting started” docker compose up silently promoted a full-authority code-execution surface — 233 tools, including shell, shared memory, and provider keys — to network-reachable and anonymously callable, without ever being asked to authorize that combination. The v3.16.3 remediation makes the failure explicit by reversing it: the Bridge now binds to 127.0.0.1 by default, publishing it requires MCP_AUTH_TOKEN, the terminal_execute tool is gated behind a server-side MCP_ENABLE_TERMINAL=true opt-in, and MongoDB requires MONGO_INITDB_ROOT_PASSWORD as a breaking change. That patch is the affirmative record of consent that was missing before — the operator now proves execution scope before the framework grants it. The gap was measurable pre-incident from configuration state alone: a static read of the compose file plus a probe of POST /mcp without an Authorization header would have surfaced it, without waiting for RufRoot to fire.

SecurityV0 Perspective

SecurityV0 classifies this pattern as unproven_execution. The Ruflo Bridge attached a code-execution tool — and 232 others — to an HTTP endpoint that the operator never explicitly authorized to be network-reachable or anonymously callable. The finding is the same shape as prior MCP failures SV0 has covered on the IDE side, but concentrated: one Bridge, one endpoint, 233 tools, and a shared memory store whose writes outlast the fix.

The control lesson extends beyond ingress. Operators need to reconcile the Bridge process identity, its resolved tool manifest, its bind and authentication settings, and every provider credential available inside the container. After exposure, they must also inspect which tools ran and which AgentDB entries changed. Shared-memory writes can survive a restart and steer future agents, so remediation cannot stop at patching the endpoint.

What To Do

  • Enumerate every agent-orchestration bridge in your fleet by ingress shape and tool inventory. For each MCP or agent bridge, record the bind address, authentication mode, CORS policy, and the resolved list of registered tools broken down by category — execution-adjacent (terminal_execute, shell, subprocess, run_python), state-mutating (memory-store, pattern-store, agent-definition writes), and credential-adjacent (LLM provider tokens in env, cloud SDK config). If any bridge lists an execution-adjacent tool alongside a non-loopback bind and a missing bearer requirement, that is a RufRoot-shape defect regardless of vendor.
  • Gate every code-execution tool behind a server-side opt-in, not a client-side flag. Ruflo’s 3.16.3 fix moves terminal_execute behind MCP_ENABLE_TERMINAL=true checked by the Bridge itself, not by the caller — the tool is not registered at all unless the operator flipped the env var at deploy time. Adopt the same shape in your own orchestrators: refuse to register shell, filesystem-write, or subprocess tools on a bridge that also serves untrusted network callers, and make the enablement a build-time or environment-time decision the runtime can audit, not a runtime toggle the model can influence.
  • Rotate every LLM provider key held in a bridge or orchestration container after any suspected exposure. RufRoot exfiltrates whatever the Bridge process can read from its environment — Anthropic, OpenAI, Google, OpenRouter keys are the documented targets, but every provider token loaded into the container is fair game. Inventory the exact set of keys each bridge container holds, keep them short-lived, and if a bridge instance was internet-reachable pre-3.16.3, rotate all of them before you assume the container was not touched.
  • Audit the AgentDB pattern-store — and every persistent memory store an agent platform reads from — after any bridge compromise. Ruflo’s release notes call out that redeploying to 3.16.3 does not undo poisoned pattern-store entries; operators must actively read the collection and remove attacker-authored rows. Extend that discipline to every long-term memory backing an agent: LangGraph checkpoints, LlamaIndex vector stores, agent-framework knowledge bases. Treat memory writes as durable authority claims that scope audits must cover, not opaque blobs.
  • Bind agent-orchestration control planes to loopback by default and require an explicit environment variable to publish them. Ruflo pre-3.16.3 shipped 0.0.0.0:3001 on the Bridge and 0.0.0.0:27017 on MongoDB out of the box; the fix inverts that to 127.0.0.1 for both, with public exposure requiring an operator-supplied auth token. Apply the same default across your own compose files, Helm charts, and Terraform modules — for MCP bridges, agent state stores, and any control plane whose scope includes running commands or writing shared memory. Public bind should be an opt-in the operator provably chose.

Sources

All posts