ruflo: unauthenticated MCP bridge exposes terminal_execute, yielding a shell and provider API keys

CVSS 10.0CVE-2026-59726AI/ML frameworks & servingcurated

Impact

ruflo's default docker-compose deployment published the MCP bridge endpoints with no authentication, and the bridge exposes a terminal_execute tool. An unauthenticated caller invokes tools/call and gets a shell in the bridge container, reads the provider API keys mounted there, and can write poisoned patterns into the AgentDB learning store so later agent runs act on attacker-controlled guidance. The key theft is the part that outlives the patch: those credentials are usually shared across a team or a whole fleet of agent runners. Persistence through the learning store also means removing the network exposure is not by itself a cleanup.

Who can reach it

Any network attacker who can reach the bridge's HTTP port. No credentials required in the default compose setup.

What to do

Upgrade to 3.16.3 and redeploy the compose stack. Rotate every provider API key the bridge container had access to, and audit or rebuild the AgentDB learning store for injected patterns. Container restart only, but treat the credential rotation as the longer piece of work.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-59726 https://github.com/ruvnet/ruflo/security/advisories/GHSA-c4hm-4h84-2cf3 https://github.com/ruvnet/ruflo/commit/d00a0a40cd8bdbca877ac7f675f416bdc69accd1 https://github.com/ruvnet/ruflo/releases/tag/v3.16.3

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.