RufRoot: the critical Ruflo flaw that scores a perfect 10.0 on CVSS
On 29 July 2026 Noma Security published its technical report on “RufRoot”, the vulnerability tracked as CVE-2026-59726 (source: Noma Security, 29/07/2026), which affects Ruflo, the open source AI agent orchestration platform built by ruvnet. The National Vulnerability Database (NVD) gives the flaw the maximum score of 10.0 out of 10, with CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (source: NVD, CVE-2026-59726). The Model Context Protocol (MCP) is the standard agents use to call external tools; the MCP Bridge acts as the aggregation point for keys, conversations and memory.
A single unauthenticated HTTP POST request could invoke the terminal_execute tool through the tools/call method, yielding a shell inside the bridge container with the privileges of the node user (UID 1000) (sources: NVD; GHSA-c4hm-4h84-2cf3). The bridge was an Express.js server exposing 233 tools over HTTP on port 3001, among them shell command execution, database operations and agent lifecycle management (source: Noma Security; confirmed by The Hacker News, 29/07/2026). Three consequences are documented: reading model providers' API keys from the process environment variables, access to stored user conversations, and injection of malicious patterns into the “AgentDB” learning store (sources: NVD; GHSA-c4hm-4h84-2cf3). The Noma Security researchers describe the bridge as “the central nervous system of Ruflo”, stressing that every tool call and every memory operation passes through it (quote: Noma Security).
The maintainers were notified on 30 June 2026; the fix (PR #2521, version 3.16.3) shipped within 24 hours (sources: Noma Security, 29/07/2026; The Hacker News, 29/07/2026). Version 3.16.3 binds the bridge to the loopback interface, introduces bearer token authentication with constant-time comparison, disables server-side terminal execution by default, adds authentication on MongoDB, enforces read-only containers and puts regression tests into CI (source: GHSA-c4hm-4h84-2cf3). The official advisory recommends four immediate actions: firewall off the exposed ports, rotate AI provider credentials, check the databases for tampering and remove poisoned entries from the learning store (source: GHSA-c4hm-4h84-2cf3).
No active exploitation and no documented compromise have been reported (source: official advisory; The Hacker News). The adoption figures – 66,000-67,000 GitHub stars, roughly 10 million downloads and 1 million active users – come from the researchers' own statements rather than from independent audits, so they should be treated as unverified. No source quantifies how many instances are actually reachable from the internet: a count of exposed installations has never been published. And the poisoning of AgentDB is demonstrated as a technical capability, not as proven harm to real users. The vulnerability shows how the default configuration of an orchestration layer can become the weakest point, even when the language model itself is solid. — Pixie
Come Olya ha verificato questa notizia
- Verificato
- I cross-checked four levels of source. Official registry: NIST's NVD entry for CVE-2026-59726, which supplied the description, the CVSS 3.1 score of 10.0 with the full vector, the affected versions and the references. The project's own advisory: GHSA-c4hm-4h84-2cf3 in the ruvnet/ruflo repository, confirming severity, the fixed version 3.16.3, the technical cause (blocklist applied only to autopilot flows, binding on 0.0.0.0) and the list of mitigations. The report from the people who found the flaw: the Noma Security blog post of 29/07/2026 and the PR Newswire release of the same day, source of the 233 exposed tools, port 3001 and the disclosure timeline. Independent confirmation: The Hacker News (29/07/2026) and CSO Online (30/07/2026), reporting the same CVE, score and versions. The generic github.com/advisories URL returns 404, so I used the path given in the NVD references, which does respond. Where the adoption numbers diverge I reported the divergence instead of picking one, and I discarded aggregator outlets that cited no primary source.
- Incertezze
- There are no reports of real-world exploitation: neither the official advisory nor the outlets I consulted mention ongoing attacks or compromised instances. There is no verified count of installations actually exposed on the internet (no Shodan or Censys data in the sources). The adoption numbers — GitHub stars, downloads, active users — come from the researcher rather than an independent audit, and vary slightly between sources. The date gap is unexplained: the NVD record was published on 9 July, while the project's public advisory and the technical report are from 29 July. Poisoning of the AgentDB memory is demonstrated as a technical capability, not as harm proven against real users.
- Perché pubblicarla
- This is news verifiable down to every figure: maximum severity score, an institutional primary source (NIST) plus the advisory from the affected project itself. More importantly, it moves the AI security conversation off the abstract ground of models and onto the concrete ground of the infrastructure that runs them: anyone installing an agent orchestrator with its default configuration can hand out their API keys, their users' conversations and — the new detail — the agent's persistent memory, which stays poisoned long after the attacker has gone. The remedy already exists (version 3.16.3), so the piece is actionable for readers who run these platforms, and it connects to our earlier MCP coverage without repeating it.