Ruflo AI agent platform exposed 233 tools through an unauthenticated MCP bridge

Noma Labs found a critical flaw in Ruflo, an open-source platform for orchestrating swarms of AI agents that acts as a harness for coding agents like Claude Code and Codex. Tracked as CVE-2026-59726 and scored 10.0, the flaw is that Ruflo's default Docker deployment exposed its Model Context Protocol bridge to the network with no authentication, offering 233 callable tools. A single unauthenticated request could invoke a shell command tool to run code in the bridge container, read AI provider API keys, steal stored conversations, and poison the platform's persistent agent memory, which can steer future outputs even after the attacker leaves. The flaw is in Ruflo, not in the coding agents.

Check

If you run Ruflo, formerly Claude Flow, update to version 3.16.3 or later, and confirm its MCP bridge is not bound to a network-reachable interface.

Affected

Teams running Ruflo before 3.16.3 with the default Docker deployment (CVE-2026-59726); an unauthenticated network attacker can run commands, steal AI provider keys and conversations, and poison persistent agent memory.

Fix

Update Ruflo, rotate AI provider API keys, rebuild affected containers from clean images, inspect the agent memory store for unfamiliar instructions, and keep MCP bridges bound to loopback and behind authentication.