Noma Security has revealed a critical vulnerability in the popular open-source AI agent orchestration tool Ruflo that allows strangers on the network to execute shell commands, steal language model API keys, and inject false memories into agent knowledge stores with a single web request.
Designated CVE-2026-59726 with the label RufRoot, it earned the maximum possible CVSS score of 10.0 and affects every Ruflo build older than release 3.16.3. Noma Security traced the source to a network-accessible MCP interface that ships without authentication guardrails, calling it the application’s central pathway for agent interactions.
This bridge runs as an Express.js server processing every tool invocation AI agents make, exposing 233 distinct capabilities including terminal commands, database queries, agent lifecycle management, and persistent memory writes. Since the /mcp endpoint accepts tool requests without verifying identity, an attacker can invoke terminal_execute to gain command execution inside the container environment.
In their proof of concept, Noma’s researchers pulled API tokens for language model providers out of environment settings, spun up unauthorized agent instances, pulled conversation history from the backing MongoDB database, and anchored persistent access mechanisms. Their most striking demonstration involved planting counterfeit records into the AgentDB pattern store, which then caused future AI outputs to reflect the intruder’s injected instructions as though they originated from the platform’s own configuration.
Industry observers noted the finding reflects a broader pattern in AI infrastructure, where development speed prioritized ease of use over authentication defaults. The memory manipulation vector is especially dangerous because contaminated records persist within a trusted repository long after the original intrusion has been cleaned up.
