Microsoft's August 2026 Patch Tuesday covered several hundred CVEs. This one isn't from that batch, and it's arguably scarier: a maximum-severity bug in a wildly popular open-source AI agent platform, found by Noma Labs and nicknamed "RufRoot."
Noma Labs found the bug in Ruflo, an open-source AI agent orchestration platform with more than 67,000 GitHub stars and a #2 ranking on MCPMarket, the kind of infrastructure a lot of teams glued into production agent workflows without a second thought. The vulnerability, tracked as CVE-2026-59726, has a maximum CVSS score of 10.0, and it earns it.
The flaw lives in Ruflo's MCP Bridge, the Express.js server that hands tool-invocation requests off to whatever agent is running. That bridge exposes 233 tools over HTTP, and in a default deployment none of them ask for a password. Noma's researchers found a tool that would run arbitrary shell commands, sent one HTTP POST request to port 3001, and had full remote code execution inside the container. No auth bypass, no chained exploit, just a request to an endpoint that was never locked in the first place.
RCE alone would be the story on most platforms. Ruflo made it worse: attackers who get in this way can pull provider API keys straight out of the deployment, read every stored conversation the agent ever had, and tamper with the AI's own memory. Noma's team calls that last part "memory poisoning" for a reason: once an attacker plants something in what the agent remembers, that manipulation can keep shaping its responses even after the box is patched and the original hole is closed. Patching the vulnerability doesn't undo what the vulnerability already taught the agent to believe.
To Ruflo's credit, the response was fast: a fix shipped within 24 hours of disclosure, and the platform's default posture changed from "exposed unless you lock it down" to "locked down unless you explicitly opt into exposure." Every version before 3.16.3 is affected.
The pattern here is bigger than one project. Ruflo isn't a niche tool, it's the kind of infrastructure teams pull in because it's popular and it works, and "233 tools over HTTP with zero authentication by default" is exactly the class of default a lot of fast-moving AI tooling ships with, because the people building it are optimizing for a demo working on the first try, not for what happens when the demo becomes production. If you're running any agent orchestration layer, MCP bridge or otherwise, the question worth asking today isn't "did we patch this one," it's "what else in this stack assumed nobody would ever send it a request from outside the trust boundary we imagined."
Sources: Noma Security, The Hacker News, CSO Online, Dark Reading, SC Media.
Top comments (0)