Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory
- ID
- 9423
- Status
- summarized
- Published
- 29 Jul 2026, 11:39 PM
- Fetched
- 31 Jul 2026, 10:38 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/07/ruflo-mcp-flaw-lets-unauthenticated.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 9.0
- Created
- 31 Jul 2026, 4:33 PM
- Tags
- Audience
- developersvibe_codersai_agent_userssaas_founders
What happened
A CVSS 10.0 vulnerability (CVE-2026-59726) in Ruflo—an open-source AI multi-agent orchestration platform formerly called Claude Flow, with 66,500+ GitHub stars—affects all versions before 3.16.3. The flaw exposes 233 tools including shell execution, database operations, and memory storage through an unauthenticated MCP bridge bound to 0.0.0.0:3001 by default in docker-compose.yml, allowing a single unauthenticated HTTP POST to achieve full remote code execution, steal LLM API keys, harvest all stored conversations, and poison AI memory.
Why it matters
If you are running Ruflo (or any MCP-bridged agent platform) in production, immediately upgrade to 3.16.3 or verify that port 3001 is not bound to 0.0.0.0 and is not network-reachable. This is a concrete reminder that MCP tool servers are powerful attack surfaces—233 tools exposed without auth means anyone on the network can execute shell commands, steal your LLM API keys, and tamper with agent memory to manipulate future outputs. Audit your docker-compose files for default 0.0.0.0 bindings on any MCP bridge.
Discussion angle
MCP bridges are becoming the new exposed-database-as-a-service attack vector—anyone wiring up agent tool servers should treat every tool endpoint as a potential RCE surface and never bind MCP bridges to 0.0.0.0 without auth, even in 'internal' deployments.