Executive brief
Ruflo, an AI agent meta-harness, contained a critical vulnerability in its default deployment configuration that exposed its internal bridge and database to the public internet without authentication. An attacker could exploit this to execute arbitrary commands on the server, steal sensitive AI provider API keys (such as OpenAI or Anthropic keys), and manipulate the AI's learning database to poison future outputs. This could lead to complete system takeover, significant financial loss from stolen API credits, and reputational damage through compromised AI behavior.
Technical details
Ruflo's default docker-compose deployment prior to 3.16.3 bound the MCP bridge and MongoDB services to all interfaces (0.0.0.0) without requiring authentication. This allowed unauthenticated network attackers to access the POST /mcp and POST /mcp/:group endpoints. By invoking the terminal_execute tool through these endpoints, an attacker could achieve remote code execution (RCE) within the bridge container. This access enabled the theft of provider API keys from environment variables, shell access, and the ability to poison AgentDB learning-store patterns. The fix in version 3.16.3 defaults service bindings to loopback (127.0.0.1), implements mandatory bearer token authentication for public exposure, and adds a server-side gate for terminal execution tools.
Affected products
- ruvnet Ruflo < 3.16.3
Timeline
- 2026-06-30: other: Maintainer decision on remediation strategy
- 2026-07-01: patched: Fixes merged and version 3.16.3 released
- 2026-07-09: disclosed: CVE-2026-59726 published