CVE-2026-59726 Details

A remote code execution vulnerability has been identified in the Ruflo application, specifically within the MCP bridge component. This issue arises in versions prior to 3.16.3, where the default Docker Compose deployment exposes the MCP bridge's POST /mcp and POST /mcp/:group endpoints without authentication. This lack of authentication allows an unauthenticated network attacker to invoke the tools/call to terminal_execute function, gaining shell access in the bridge container. Additionally, the vulnerability enables access to provider API keys, manipulation of the AgentDB learning store, and exploitation of the victim's API keys by spawning attacker-controlled swarms. The vulnerability is rooted in the absence of authentication for critical endpoints, combined with a default deployment that exposes these endpoints to the network.

Users can update to Ruflo version 3.16.3 or later, where this vulnerability has been patched. After updating, it is recommended to audit the AgentDB pattern store for any injected entries and purge them, as the patch alone does not undo the effects of the poisoning vector.