Ruflo is an open-source agent meta-harness built to orchestrate Anthropic Claude Code and OpenAI Codex sessions, giving teams a way to run, coordinate, and persist memory across coding agents on their own infrastructure. Noma Security’s research arm, Noma Labs, found that every version before 3.16.3 shipped with a Model Context Protocol bridge, the layer that lets external tools call into the agent, that accepted commands from anyone who could reach it on the network, no credentials required.
233 tools, zero authentication, one open port
The bridge exposed 233 tools covering shell command execution, database operations, agent management, and memory storage, all through two endpoints, POST /mcp and POST /mcp/:group, that performed no authentication check. By default, Ruflo’s docker-compose deployment binds this bridge to port 3001 on all network interfaces rather than localhost, which meant any self-hosted instance reachable from a wider network was reachable by anyone on it. An attacker who found the port open could call tools/call against terminal_execute and get a working shell inside the bridge container immediately, no exploit chain, no privilege escalation, just an API call the software was built to accept from the first party that asked.
The part that outlasts the patch: memory poisoning
The shell access alone would be enough to justify the CVSS 10.0 score, but the same unauthenticated path also let an attacker read provider API keys out of the running environment and write directly into AgentDB, Ruflo’s persistent learning store. That second capability is the one worth sitting with. An agent’s memory is meant to make it more useful over time by remembering what worked. A write-access flaw in that store means an attacker does not just get a one-time shell, they can plant instructions or false context that the agent will trust and act on in future sessions, long after the original access point is closed. Noma disclosed the flaw responsibly on June 30, 2026, and maintainer Reuven Cohen shipped a fix within 24 hours: the bridge now binds to loopback by default, terminal_execute sits behind server-side execution controls, and MongoDB authentication is enabled to stop conversation theft.
Why this keeps happening to agent infrastructure specifically
RufRoot is not an isolated incident, it is the latest in a pattern we have covered repeatedly this year across MCP servers, coding-agent extensions, and self-hosted agent platforms: software built fast to capture the agentic AI wave, shipping with a default configuration that trades security for a working demo out of the box. Teams adopting these tools for real development work are effectively standing up a new class of infrastructure, one with direct execution privileges and persistent state, and doing it faster than their own security review processes can keep pace with. A network scan for open MCP ports is now as relevant to an internal audit as a scan for exposed databases used to be.
If your organisation is running self-hosted AI agent or MCP infrastructure and needs an independent review of what is actually reachable from your network, or wants help building a review process for agentic tooling before it goes into production, contact Excello Digital. We help European engineering teams adopt AI development tools without opening a shell to the internet.