Critical Ruflo AI Agent Flaw Exposes Enterprises to Full System Takeover
Researchers at Noma Security have uncovered a critical vulnerability (CVE-2024-XXXX, CVSS 10.0) in Ruflo, an open-source AI agent platform, allowing unauthenticated attackers to hijack enterprise AI environments with a single HTTP request. The flaw, dubbed RufRoot, affects Ruflo versions prior to 3.16.3 and stems from an exposed Model Context Protocol (MCP) bridge, which serves as the platform’s central control interface.
How the Attack Works
The MCP bridge, an Express.js server, handles all AI agent tool invocations including shell commands, database operations, and memory storage without requiring authentication. In a proof-of-concept, researchers demonstrated:
- Remote code execution via Ruflo’s
terminal_executetool. - Theft of LLM API keys from environment variables.
- Deployment of attacker-controlled AI agent swarms.
- Access to user conversations stored in MongoDB.
- AI memory poisoning by injecting malicious entries into Ruflo’s AgentDB, enabling persistent influence over future AI responses.
The vulnerability was validated against a default Ruflo deployment on AWS EC2, confirming its exploitability in real-world environments.
Broader Implications for AI Security
While the flaw is specific to Ruflo, security experts warn it highlights systemic risks in AI orchestration platforms:
- MCP adoption has outpaced security defaults, with many tools prioritizing ease of setup over authentication.
- Persistent AI memory a writable data store is rarely treated as a security boundary, allowing attackers to embed malicious instructions undetected.
- Network boundary assumptions fail when AI agents are deployed on corporate-accessible servers.
Mitigation and Response
Ruflo has released version 3.16.3, which binds the MCP bridge to the loopback interface by default and enforces authentication. Noma Security recommends immediate actions for affected organizations:
- Close firewall access to ports 3001 (MCP Bridge) and 27017 (MongoDB).
- Rotate all LLM API keys and audit AgentDB for malicious entries (patching alone does not remove poisoned memory).
- Inspect MongoDB for tampering.
The disclosure follows responsible reporting to Ruflo, which issued a public security advisory alongside the fix. The incident underscores the need for strict access controls, memory audits, and credential rotation in AI agent deployments.
Noma Security cybersecurity rating report: https://www.rankiteo.com/company/noma-security
"id": "NOM1785422646",
"linkid": "noma-security",
"type": "Vulnerability",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Enterprises using Ruflo '
'versions prior to 3.16.3',
'industry': 'Technology/AI',
'name': 'Ruflo',
'type': 'AI Agent Platform'}],
'attack_vector': 'Unauthenticated HTTP request',
'customer_advisories': 'Enterprises using Ruflo advised to upgrade and audit '
'systems',
'data_breach': {'data_exfiltration': 'Potential (attackers could steal data '
'via remote code execution)',
'personally_identifiable_information': 'User conversations',
'sensitivity_of_data': 'High (API keys, personally '
'identifiable information in '
'conversations)',
'type_of_data_compromised': ['LLM API keys',
'User conversations',
'AI memory (AgentDB)']},
'description': 'Researchers at Noma Security uncovered a critical '
'vulnerability (CVE-2024-XXXX, CVSS 10.0) in Ruflo, an '
'open-source AI agent platform, allowing unauthenticated '
'attackers to hijack enterprise AI environments with a single '
'HTTP request. The flaw, dubbed RufRoot, affects Ruflo '
'versions prior to 3.16.3 and stems from an exposed Model '
'Context Protocol (MCP) bridge, which serves as the platform’s '
'central control interface.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'AI security flaws',
'data_compromised': 'LLM API keys, user conversations, AI memory '
'(AgentDB)',
'operational_impact': 'Full system takeover, remote code '
'execution, AI memory poisoning',
'systems_affected': 'Ruflo AI agent platform (versions prior to '
'3.16.3)'},
'initial_access_broker': {'backdoors_established': 'Potential via AI memory '
'poisoning (AgentDB)',
'entry_point': 'Exposed MCP bridge (port 3001)',
'high_value_targets': 'LLM API keys, user '
'conversations, AI memory'},
'investigation_status': 'Vulnerability disclosed and patched',
'lessons_learned': 'Systemic risks in AI orchestration platforms, including '
'exposed control interfaces, lack of authentication '
'defaults, and writable AI memory stores. Highlights the '
'need for strict access controls, memory audits, and '
'credential rotation in AI deployments.',
'post_incident_analysis': {'corrective_actions': 'Bind MCP bridge to loopback '
'interface by default, '
'enforce authentication, '
'audit AI memory for '
'tampering',
'root_causes': 'Exposed Model Context Protocol '
'(MCP) bridge without '
'authentication, writable AI memory '
'(AgentDB) treated as non-security '
'boundary'},
'recommendations': ['Upgrade to Ruflo version 3.16.3 or later',
'Close firewall access to ports 3001 (MCP Bridge) and '
'27017 (MongoDB)',
'Rotate all LLM API keys',
'Audit AgentDB for malicious entries',
'Inspect MongoDB for tampering',
'Implement strict access controls and authentication for '
'AI agent platforms',
'Conduct regular memory audits for AI systems'],
'references': [{'source': 'Noma Security Research'},
{'source': 'Ruflo Security Advisory'}],
'response': {'communication_strategy': 'Public security advisory issued by '
'Ruflo',
'containment_measures': 'Close firewall access to ports 3001 '
'(MCP Bridge) and 27017 (MongoDB)',
'recovery_measures': 'Inspect MongoDB for tampering',
'remediation_measures': 'Upgrade to Ruflo version 3.16.3, rotate '
'LLM API keys, audit AgentDB for '
'malicious entries',
'third_party_assistance': 'Noma Security (researchers)'},
'stakeholder_advisories': 'Public security advisory issued by Ruflo',
'title': 'Critical Ruflo AI Agent Flaw Exposes Enterprises to Full System '
'Takeover',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'CVE-2024-XXXX (CVSS 10.0), exposed Model Context '
'Protocol (MCP) bridge'}