DEV Community

Anoymask
Anoymask

Posted on

RufRoot (CVE-2026-59726): Full Compromise of AI Agent Infrastructure via Unauthenticated MCP Bridge

#security #threatintel

RufRoot (CVE-2026-59726): Full Compromise of AI Agent Infrastructure via Unauthenticated MCP Bridge

1. Basic Information

2. Executive Summary

A single unauthenticated POST request to Ruflo's MCP Bridge (which is exposed on all interfaces by default) allows command execution inside the container. This enables attackers to steal, modify, and persist LLM API keys, conversations, memory, and agent swarms.

3. Attack Flow

  1. An attacker reaches the Ruflo MCP Bridge on TCP/3001.
  2. The attacker lists 233 tools without authentication using tools/list.
  3. The attacker sends a JSON-RPC tools/call to /mcp and executes commands using ruflo__terminal_execute.
  4. The attacker steals LLM provider API keys using commands like printenv.
  5. The attacker creates attacker-controlled swarms and agents using the victim's keys and compute resources.
  6. The attacker saves malicious patterns to AgentDB to poison the memory of future outputs.
  7. The attacker dumps conversations and metadata from the unauthenticated MongoDB and sends them externally.
  8. The attacker creates /app/beacon.js, injects a load into index.js, and achieves persistence through Docker restarts after PID 1 exits.
  9. The attacker clears the shell history.

4. Attacker Position and Execution Location

The attacker sends an HTTP POST request from any network-reachable location. Commands run as the node user (UID 1000) inside the Docker container, reaching the internal Docker network, MongoDB, environment variables, and agent APIs.

5. Visibility for Victims and Administrators

  • No user action or prompt is required.
  • The activity looks like an HTTP request similar to a normal MCP tool call.
  • New swarms, agents, memory patterns, and conversation access may appear on the management dashboard.
  • Host-level EDR alone may miss the node user activity, temporary MongoDB client usage, and file modifications inside the container.

6. Conditions for Success and Failure

Success Conditions

  • Using a vulnerable version of Ruflo with TCP/3001 reachable by the attacker.
  • /mcp lacks authentication, IP restrictions, and reverse proxy protection.
  • Default shared environment variables, unauthenticated MongoDB, and restart policies remain in place.

Failure Conditions

  • Updating to the patched version.
  • Restricting the Bridge to localhost or a management network, and adding authentication and network policies.
  • Isolating the container from sensitive environment variables, internal databases, and outbound communications.

7. Impact of a Successful Attack

The attack results in unauthorized use of LLM budget and API privileges, theft of conversations and sensitive data, long-term pollution of AI memory, creation of attacker-controlled agents, and container persistence. If the agents have access to internal databases, source code, or cloud permissions, the impact expands beyond Ruflo.

8. Observable Logs

  • Email: Generally none.
  • Proxy/SWG/DNS: Unknown OAST/external destinations from Ruflo, sudden spikes in LLM API traffic, and package downloads.
  • Endpoint/EDR: node child processes, printenv, MongoDB client, /tmp, /app/beacon.js, modifications to index.js, and PID 1 exit.
  • Identity/IdP: Abnormal use of LLM API keys. Human ID logs may not show this activity.
  • SaaS/Cloud: New swarms/agents, abnormal tool calls, AgentDB writes, and EC2/container audits.
  • Network: External requests to TCP/3001 /mcp, tools/list, and terminal_execute, along with OAST and data exfiltration from the container.

9. Attack Success Determination

  • Contact Only: Port 3001 scan, tools/list.
  • User Action: Not required.
  • Initial Execution: terminal_execute response, OAST callback.
  • Malware or Auth Success: API key acquisition and unauthorized use, creation of attacker agents.
  • Data Theft / Session Compromise: MongoDB conversation dump and external transmission.
  • Subsequent Compromise Confirmation: Memory poisoning, beacon persistence, and access to cloud or internal resources outside Ruflo.

10. Investigation Playbook

  • Trigger: External access to port 3001, unauthenticated /mcp, terminal_execute, creation of unknown agents.
  • Initial Verification: Confirm the version, exposure scope, access logs, container ID, and key locations.
  • Endpoint: Preserve container filesystem diffs, processes, /app and /tmp, restart history, and Docker events.
  • Authentication / Cloud: Review usage history for all LLM/API keys, cloud audit logs, and secret management systems.
  • Subsequent Activity: Investigate AgentDB, MongoDB, conversations, generated agents, external communications, and accessible internal resources.
  • Containment: Block port 3001, isolate and rebuild the container, revoke all keys, add database credentials, and restore memory and code to a known good state.
  • Status Classification: Exposed / Enumerated / RCE / Secrets Stolen / Agent or Memory Compromised / Data Exfiltrated / Downstream Compromise.

11. Defense and Detection Ideas

  • Single Event: External POST /mcp, terminal_execute, printenv, agentdb_pattern-store, new beacon.
  • Timeline Correlation: tools/list → shell execution → environment variable enumeration → agent creation → database dump → file modification → restart.
  • Hunting: Search for Ruflo instances with port 3001 exposed publicly or internally, shadow AI assets, and abnormal LLM key usage.
  • Log Gaps: Without MCP tool audits, container process logs, and AgentDB change history, the scope of modification cannot be determined.
  • Priority Actions: Update software, restrict public access, implement authentication, isolate secrets, control egress traffic, enforce least privilege for containers, and integrate AI operation logs into the SIEM.

12. Facts / Inference / Hypothesis

Facts

  • Noma Labs verified an 8-stage PoC using a default AWS EC2 configuration.
  • /mcp exposed 233 tools without authentication and allowed shell execution by bypassing blocklists.
  • Even with UID 1000, attackers could reach API keys, conversations, databases, memory, and persistence mechanisms.

Inference

  • This is an unauthenticated RCE in the AI control plane, not an LLM prompt injection.
  • The wider the permissions of the agent infrastructure, the greater the downstream impact.

Hypothesis

  • Requiring principal authentication and policy decision logs for every MCP call will significantly reduce the impact of similar flaws.

13. MITRE ATT&CK Mapping

  • High Confidence: T1190 Exploit Public-Facing Application, T1059 Command and Scripting Interpreter, T1552.001 Credentials In Files/Environment, T1005 Data from Local System, T1505 Server Software Component, T1070 Indicator Removal.
  • Medium Confidence: T1098 Account Manipulation (if agent creation is treated as identity manipulation), T1556 Modify Authentication Process, T1041 Exfiltration Over C2.

14. Unknowns and Further Investigation

  • Patched versions and current deployment counts.
  • Default retention period for Bridge access logs.
  • Presence of known active exploitation in the wild.
  • Potential for container escape.
  • Organization-specific permissions associated with stolen keys.

15. Impact on SOCs and General Organizations

Shadow AI deployed independently by developers often bypasses asset inventories and frequently has access to API keys and internal networks. SOCs must treat not only AI product names, but also MCP Bridge listening ports, tool audits, agent IDs, and memory changes as new monitoring targets.

16. Summary by Role

  • For SOC Teams: Detect the chain of port 3001 exposure, MCP tool enumeration, shell execution, key usage, and agent/memory modifications.
  • For Administrators: Update and unpublish Ruflo, rotate all API keys, and rebuild containers.
  • For Users: Do not expose AI agent infrastructure to internal or external networks without proper authorization.

Top comments (0)