Ruflo MCP Unauthenticated RCE and Memory Poisoning (RufRoot)
First seen Jul 30, 2026 · Updated Jul 30, 2026 · CVSS 10
A maximum-severity vulnerability (CVSS 10.0) in Ruflo, an open-source meta-harness used to orchestrate Claude Code and OpenAI Codex agents via MCP, allows unauthenticated attackers to remotely execute arbitrary commands and poison the agent's persistent memory. This flaw, dubbed RufRoot, affects all versions prior to 3.16.3 and poses severe risk to any deployment exposing the Ruflo MCP interface without proper authentication controls.
Technical Analysis
Ruflo exposes an MCP-based interface for coordinating agentic workflows between Claude Code and OpenAI Codex, but reportedly lacks authentication checks on critical endpoints, allowing unauthenticated remote actors to invoke privileged tool functions. This enables direct remote code execution on the host running the harness, giving attackers full control over the underlying system. Because Ruflo also manages persistent agent memory/context, attackers can inject or corrupt stored memory objects, causing downstream agent sessions to act on poisoned instructions or false context (memory poisoning). The entry point crosses both the tool-invocation boundary (unauthenticated MCP tool calls) and the memory boundary (persisted state trusted by future agent runs), amplifying blast radius across any agent instance relying on the compromised harness.
Affected Systems
Ruflo; protocols: MCP
Detection Signatures
- Unauthenticated requests to Ruflo MCP server endpoints without valid session/auth tokens
- Unexpected process spawning or shell command execution originating from Ruflo harness processes
- Anomalous or unauthorized writes to agent memory/context stores
- Inbound connections to Ruflo MCP port from untrusted or external IP ranges
- Log entries showing tool invocation calls with missing or malformed authentication headers
Remediation Steps
- 1
Upgrade Ruflo immediately
Update all Ruflo deployments to version 3.16.3 or later, which patches CVE-2026-59726.
- 2
Restrict network exposure
Ensure Ruflo MCP endpoints are not exposed to the public internet; place behind VPN, firewall, or authenticated reverse proxy.
- 3
Enforce authentication on MCP interfaces
Verify and enforce strong authentication/authorization on all MCP tool-invocation endpoints, rejecting unauthenticated requests by default.
- 4
Audit and reset agent memory
Inspect persisted agent memory/context for signs of tampering and purge or restore from known-good backups if poisoning is suspected.
- 5
Monitor for exploitation indicators
Review logs for unauthorized command execution and unusual MCP traffic patterns; deploy runtime monitoring on hosts running Ruflo.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.