Critical Ruflo MCP Bridge RCE (CVE-2026-59726) Exposes AI Keys, Poisons Data

A critical vulnerability disclosed last week exposes just how dangerous default configurations can be in the fast-moving world of AI agent orchestration tools.

Tracked as CVE-2026-59726, the flaw affects ruflo, an npm package used to deploy Model Context Protocol (MCP) bridges via Docker Compose.

With a maximum CVSS score indicating network-based, zero-interaction exploitability, this vulnerability enabled unauthenticated attackers to gain full shell access, steal API keys, and corrupt AI training data across affected instances.

Critical Ruflo MCP Bridge RCE

The core issue traces back to how ruflo’s default docker-compose.yml exposed the MCP bridge. The configuration bound both the bridge service and its MongoDB backend to all network interfaces rather than restricting access to localhost.

This meant any instance deployed with default settings was reachable from the public internet with zero authentication required on the POST /mcp endpoint.

Attackers could send crafted requests invoking tools/call to trigger terminal_execute, a function that grants command execution inside the bridge container. Because the container ran as the node user (uid 1000), successful exploitation handed attackers a working shell without needing credentials, exploit chains, or user interaction.

Ruflo did include a tool blocklist meant to restrict dangerous functions like terminal_execute. However, researchers found that this protection applied only within the autopilot workflow.

The two primary API routes, POST /mcp and POST /mcp/:group, bypassed the blocklist entirely, leaving the most direct attack path completely unguarded.

This is a textbook example of CWE-306 (Missing Authentication for Critical Function) compounded by CWE-78 (OS Command Injection), where a security control exists on paper but fails to cover the actual entry points attackers use.

What separates this vulnerability from a standard container breakout is its downstream impact on AI behavior itself. Once inside, attackers could read every provider API key stored in the container’s environment variables, including OpenAI, Anthropic, Google, and OpenRouter credentials.

That access alone enables costly abuse, from spinning up attacker-controlled AI workloads billed to the victim’s account to broader credential theft.

More concerning is the ability to inject poisoned entries into AgentDB, Ruflo’s pattern-learning store. Because this store informs future AI outputs for all users of an instance, a single successful attack could quietly bias or corrupt agent behavior long after the initial breach, without any indication that patterns were tampered with.

The remediation, delivered through ADR-166 and merged in PR #2521, addresses the vulnerability across multiple layers:

Loopback binding by default, with fail-closed behavior if public binding is requested without setting MCP_AUTH_TOKEN
Bearer token authentication using timing-safe comparison to prevent timing attacks
Server-side gating of terminal_execute, now disabled unless explicitly enabled via MCP_ENABLE_TERMINAL=true
MongoDB authentication enforced by default, requiring MONGO_INITDB_ROOT_PASSWORD to boot
Read-only container filesystem paired with tmpfs
CORS allowlist enforcement, closing the CWE-942 cross-domain exposure
CI regression tests locking in these defaults going forward

Patching to version 3.16.3 alone does not undo damage from prior exploitation. Security researchers Eli Ainhorn of Noma Security and Dragan Spiridonov, who co-authored the fix, stress that operators running exposed instances must take immediate remediation steps beyond updating the package.

Recommended actions include immediately firewalling ports 3001 and 27017, rotating all provider API keys, auditing AgentDB for injected pattern entries and purging any poisoned data, and reviewing MongoDB for signs of tampering.

Given the stealthy nature of pattern poisoning, organizations should treat any previously exposed instance as potentially compromised regardless of whether obvious symptoms appear.