Overview
- Security researchers at Noma Labs disclosed the flaw on June 30, 2026 and showed a proof-of-concept that an unauthenticated network request could seize control of a default Ruflo deployment.
- The default docker-compose.yml bound Ruflo’s Model Context Protocol (MCP) bridge and MongoDB to 0.0.0.0, exposing port 3001 and allowing a single POST /mcp call to invoke tools/call → ruflo__terminal_execute.
- That call gave a shell in the bridge container and access to 233 tools, which could let an attacker steal LLM provider API keys, read stored conversations, deploy backdoors, spawn agent swarms, and write malicious patterns into AgentDB.
- Ruflo released version 3.16.3 within 24 hours to bind the bridge to loopback, gate terminal_execute, and enable MongoDB authentication, and operators are advised to update immediately and also rotate keys, rebuild containers from clean images, close ports 3001 and 27017, and audit AgentDB.
- No confirmed active exploitation has been reported so far, but the incident shows how insecure default deployments can create large attack surfaces and that removing poisoned AI memory requires forensic checks beyond a normal software patch.