al-ice.ai

Ruflo’s Default Docker Stack Exposed an Unauthenticated MCP Shell — CVE-2026-59726

AI CVEs by al-ice.ai Editorial

Ruflo’s default Docker Compose deployment placed an unauthenticated Model Context Protocol bridge on all network interfaces and let callers reach a terminal tool. In affected releases, a network client could submit tools/call to POST /mcp, invoke terminal_execute, and obtain a shell inside the bridge container without credentials.

The issue is tracked as CVE-2026-59726 and GHSA-c4hm-4h84-2cf3. The affected npm package range is Ruflo before 3.16.3; version 3.16.3 shipped the coordinated fix on July 1. GitHub’s maintainer advisory assigns CVSS 3.1 10.0 Critical. The CVE record was published July 9.

This is more than a container-shell bug. Ruflo is an agent meta-harness for Claude Code and Codex, and the bridge container received model-provider credentials through its environment. The advisory says a successful attacker could read those keys, run swarms on the victim’s accounts, reach an unauthenticated MongoDB service, and write poisoned patterns into the AgentDB learning store. That last effect makes incident response stateful: replacing the vulnerable image does not remove instructions already persisted into agent memory.

Three defaults completed the chain

The vulnerable path combined separate trust failures. First, the shipping Compose file published bridge port 3001 and MongoDB port 27017 without restricting them to loopback. Second, the MCP HTTP routes did not authenticate callers. Third, the existing terminal blocklist applied only to the autopilot flow, while the primary /mcp and /mcp/:group request paths could still reach the tool executor.

That distinction is important. A control attached to one orchestration mode is not a tool authorization boundary when another route reaches the same capability. The fixing pull request moved the denial into the shared executeTool() function so every current request path encounters it. Terminal execution is now disabled unless an operator explicitly sets MCP_ENABLE_TERMINAL=true.

The project’s ADR-166 says maintainers statically verified the coordinated disclosure against the source rather than reproducing it against a live target. It records an eight-step proof of concept and a reported default deployment on AWS EC2, but the public sources do not establish widespread exploitation. Defenders should treat internet exposure as an incident condition without describing the vulnerability as exploited in the wild.

Version 3.16.3 changes the deployment contract

The patch makes the bridge local-only by default. Both bridge implementations and the agent-federation plugin now default to 127.0.0.1; the default Compose mappings also bind the bridge and MongoDB to loopback. An operator can still choose a public bind, but Ruflo now exits at startup if that bind is configured without MCP_AUTH_TOKEN.

When a token is configured, middleware requires a bearer token and compares it with Node’s timingSafeEqual. The release also enables MongoDB authentication, requires a root password before Compose will start, gives the bridge a read-only root filesystem with a temporary /tmp, and wires a configurable CORS allowlist. Static and runtime regression tests check both bridge copies for authentication, loopback binding, fail-closed public exposure, and the terminal gate.

The change is defense in depth rather than a single authentication patch. Loopback binding reduces accidental network exposure; bearer authentication covers an intentional remote listener; server-side tool authorization limits what an authenticated caller can invoke; and a read-only root filesystem constrains persistence inside the bridge container. None substitutes for scoping the provider credentials injected into that process.

Patched does not mean investigated

  • Upgrade all Ruflo packages and deployments to 3.16.3 or later. Verify the running container or process, not only the package manifest. Recreate workloads so old bridge code is no longer listening.
  • Identify historical exposure of ports 3001 and 27017. Review cloud security groups, host firewalls, reverse proxies, Docker port mappings, and network telemetry for the full period the affected stack ran.
  • Rotate model-provider credentials available to the bridge. The advisory specifically names OpenAI, Google, OpenRouter, and Anthropic keys. Revoke old values and examine provider logs for unfamiliar usage, models, source addresses, or spend.
  • Audit AgentDB rather than trusting a clean image. Search the pattern store for unexpected agentdb_pattern-store entries and validate persisted guidance against a known-good baseline. Purge malicious patterns before returning agents to service.
  • Investigate MongoDB for access or tampering. Preserve relevant logs first, then examine accounts, conversations, configuration, and data changes. Enabling authentication after compromise does not explain prior writes.
  • Keep terminal tools off unless a documented workflow requires them. If enabled, isolate the bridge, minimize environment credentials, restrict egress and filesystem access, and put tool-level policy behind the same authorization path used by every transport.
  • Treat a public bind as an explicit security architecture. Require authentication at the first reachable hop, use TLS, limit source networks, rate-limit requests, and ensure each tenant has a separate process, memory domain, and credential set where practical.

The site’s analysis of AWS API MCP Server’s fail-open policy behavior showed the same structural problem from another direction: a policy is not a boundary if a request path can bypass it. The n8n security-release briefing likewise emphasizes verifying credential and sandbox blast radius instead of treating an agent-platform update as ordinary dependency hygiene.

CVE-2026-59726 joins those lessons in one default stack. MCP authentication, tool authorization, secret isolation, and durable agent memory are separate control planes. Ruflo 3.16.3 closes the disclosed route, but operators that exposed the old bridge need evidence that keys, databases, and learned behavior remain trustworthy.

Sources: