Critical Ruflo vulnerability gives command execution without login

On 29 July 2026 Noma Labs disclosed CVE-2026-59726 in Ruflo, an open platform for building and running swarms of AI agents. In the default Docker Compose deployment the platform MCP bridge bound to every network interface on port 3001, without authentication. The bridge exposes 233 tools, and one of them runs arbitrary shell commands inside the container. Noma Labs states that a single unauthenticated HTTP request was enough for full command execution. NVD states that the issue affects versions prior to 3.16.3, and that it is fixed in 3.16.3. The score of 10.0 was assigned by GitHub acting as CVE numbering authority, while NVD has not provided its own assessment.

What happens technically

The MCP bridge is a server that accepts tool calls under the Model Context Protocol, and it is the point through which all agent activity in Ruflo passes. The POST /mcp endpoint accepted calls and passed them straight to execution with no authentication layer. A blocklist against dangerous commands existed, but it applied only within the automatic workflow, and the endpoint bypassed it entirely. Among the 233 tools sits a terminal execution tool, which runs commands as the container's ordinary user. The vector NVD reproduces from the numbering authority, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, expresses that the attack happens over the network, without privileges and without user interaction, that the impact is full on confidentiality, integrity and availability, and that it reaches beyond the vulnerable component. The weakness types are given as missing authentication for a critical function, command injection and a permissive cross domain policy.

Noma Labs demonstrates an eight step chain confirmed against a default deployment. First the tools are enumerated, then commands are executed. The keys for the language model providers are passed in as environment variables in the deployment and inherited by the backend processes, so a simple environment dump collects them all. The attacker can then start their own agent swarms on the victim's keys and compute, poison the agent learning store so that future answers are influenced, and pull conversations from a MongoDB that ran without authentication on the internal network. Finally a backdoor is placed as a new file in the application directory, loaded at start up, where the container restart policy makes sure it comes back. The vendor fixed the issue within a few hours in a single change, and the fix binds the bridge to loopback by default, requires an access token, disables the terminal tool unless it is explicitly enabled, requires authentication in the database and runs the container read only. NVD registered the entry on 9 July 2026, while Noma Labs published its analysis on 29 July.

What this means for you if you run agent platforms yourself

This is a case about shadow AI before it is a case about a single product. Platforms like this are set up by a developer or a department that wants to get moving quickly, often with a couple of commands and their own API keys. If a platform like that is standing in your environment, it is worth knowing what changes the moment it is set up. The way we see it, the risk picture changes character there and then. An agent platform needs deep access to its surroundings in order to be useful, and it therefore gathers credentials, data and execution rights in one place. If that place stands open without a login, what the attacker has found is not a misconfiguration in a peripheral service. It is free access to everything the platform can do.

The cost of an incident like this also has a tail that is easy to underestimate. Keys for language model providers can be used to run up bills, and to run attacks in your organisation's name. Poisoning of the agent memory is worse, because it survives a new deployment. A patched version does not remove the patterns that have already been injected, and they keep influencing the answers without you seeing why. We therefore want to warn you against treating the patch as the end of the incident. If your organisation falls under NIS2, this is a concrete expression of the Article 21 requirements for secure configuration and vulnerability handling, and ISO/IEC 42001 gives you the frame for governing which AI platforms are allowed to run at all.

Berigo recommends

• Search for Ruflo deployments in your own environments, including those set up outside the IT department, and update to version 3.16.3 or later.
• Close ports 3001 and 27017 to the network, as the vendor itself recommends, and verify that the bridge only listens locally.
• Rotate every language model provider key that has been set as an environment variable in an exposed deployment.
• Review the agent learning store and the conversation database for injected patterns and exfiltration. A patch does not remove poisoning that is already there.
• Require that MCP servers are treated like any other interface to sensitive resources: authentication on every request, as few tools available as possible, and no network exposure without an explicit need.