Summary
- NVD records CVE-2026-59726 as an unauthenticated remote code execution issue in Ruflo’s default Docker Compose MCP bridge deployment.
- The exposed bridge allowed tool invocation, terminal execution, provider API key access, and AgentDB learning-store poisoning before version 3.16.3.
- The flaw shows how AI agent infrastructure can become a privileged management surface when identity and access controls are missing.
Noma Security has disclosed a critical vulnerability in Ruflo, an open-source AI agent orchestration platform, that exposed the platform’s Model Context Protocol bridge to unauthenticated command execution in default Docker Compose deployments.
The flaw, tracked as CVE-2026-59726 and named RufRoot by Noma Labs, affects Ruflo versions before 3.16.3. NVD records describe the issue as unauthenticated remote code execution in the MCP bridge default Docker Compose deployment.
The vulnerable deployment exposed POST /mcp and POST /mcp/:group endpoints without authentication. According to NVD, an unauthenticated network attacker could invoke tools/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns.
The issue reflects a practical risk in fast-moving AI infrastructure. Agent orchestration platforms are designed to connect models to tools, data, workflows, and systems. Their value comes from allowing agents to act, but that same capability creates a privileged interface where ordinary application controls may not be enough.
Enterprise systems usually place privileged operations behind identity controls, network segmentation, service accounts, logging, and change management. AI agent tooling has not always inherited those controls. Developers may deploy experimental infrastructure with broad tool access, persistent memory, and API keys before security teams have inventory coverage or a clear owner for the service.
An exposed MCP bridge is more direct than a prompt-injection problem. Attackers do not need to persuade a model to misbehave if they can reach the tool interface themselves. In that scenario, the failure is familiar: unauthenticated access to a sensitive management endpoint that can run commands and handle credentials.
Organisations experimenting with agentic AI should inventory MCP servers, bridge components, local developer containers, agent memory stores, API keys, and tool permissions. These services need ownership, authentication, network restriction, logging, and lifecycle management before they are connected to business systems, repositories, cloud accounts, ticketing platforms, or data stores.
Supplier assurance will also need to adapt. A business unit may adopt an open-source agent framework through a small pilot while the security team still sees AI use as limited to approved SaaS tools. Once the framework reaches internal data or automation workflows, a default deployment mistake can become an enterprise access incident.
Immediate remediation is to upgrade Ruflo to version 3.16.3 or later and remove unauthenticated access to MCP bridge endpoints. Longer-term controls should treat agent tooling as privileged infrastructure, with defined access boundaries, accountable owners, and evidence of what each agent or tool can do.
