Ruflo's maximum-severity flaw shows what an unauthenticated AI agent bridge actually does

An open-source platform for running AI agents shipped its central control plane without authentication, and a single HTTP request to the platform's default-exposed /mcp endpoint was enough to run code, steal LLM provider API keys, hijack the agents themselves, and rewrite the system's persistent AI memory. The bug carries a maximum CVSS score of 10.0 and is tracked as CVE-2026-59726; the discoverers at Noma Security have dubbed it RufRoot. The patch is one thing; the architectural default underneath it is the category problem. Agentic AI platforms increasingly ship a central tool bridge, and they increasingly ship it without authentication, which is why a routine HTTP request becomes a path to full enterprise-AI compromise.

Ruflo is an agentic platform: software that lets developers assemble "agents," small LLM-driven programs that take real action, not just generate text, by calling tools. To make that work, the platform exposes a tool bridge built on the open Model Context Protocol (MCP) standard, an Express.js server that lets any agent call 233 separate tools covering shell execution, database operations, agent management, and persistent memory storage. The /mcp endpoint on that bridge is, in the researchers' framing, the platform's central nervous system, and by default it accepts tool invocations without authentication.

That single design choice is what turned the proof of concept into a compromise. A researcher sends one unauthenticated HTTP request to /mcp, and the bridge treats it as a trusted tool call. From there, the path branches: invoke the terminal_execute tool for arbitrary code execution inside the container, enumerate every other tool the platform exposes, read environment variables to harvest the API keys that let the agents call an LLM provider, query the underlying MongoDB to pull stored user conversations, and write new entries into the platform's persistent AI memory, the long-lived context an agent uses to plan across sessions. With agent and memory access, the attacker can then deploy attacker-controlled agents inside the same fleet and keep the foothold.

The disclosure, tracked as GitHub Security Advisory GHSA-c4hm-4h84-2cf3 in ruvnet/ruflo, affects all Ruflo versions prior to 3.16.3 and ships with a working proof-of-concept. The remediation in product terms is straightforward: upgrade and remove the default unauthenticated access to the MCP Bridge. The underlying posture is the part that should travel beyond this one CVE. An MCP bridge fronting 233 tools is, by definition, the platform's most capable control plane. Shipping it without authentication is not a missing login screen; it is a category-level choice about how the platform assumes trust.

That is the question enterprise security teams should now be asking of every agentic AI deployment they touch: is the platform's tool bridge authenticated by default, and how many capabilities does it front? That same architectural default, a powerful MCP-style bridge exposed without authentication in front of the tool calls, is showing up across the agentic AI stack. RufRoot is the cleanest public case so far, not the only one.

The patch advisory lives at the GitHub security advisory above; the canonical record is the NVD entry. The Ruflo maintainer's public statement, if any, was not visible in the source materials at the time of this draft.