Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory Ruflo MCP 漏洞允许未认证攻击者运行命令并毒化 AI 记忆

TL;DR

• A critical security vulnerability (CVE-2026-59726, CVSS 10.0) in Ruflo allows unauthenticated remote code execution via an exposed Model Context Protocol (MCP) bridge on port 3001 by default.
• The flaw enables attackers to execute arbitrary shell commands, steal LLM API keys, poison AI memory, and persist malicious behavior across future user interactions.
• The vulnerability affects all versions prior to 3.16.3 and was patched within 24 hours of responsible disclosure, with the MCP bridge now bound to localhost and authentication enforced.
• Remediation requires not only updating but also rotating credentials, auditing persistent memory stores, and rebuilding containers from clean images due to potential compromise.

Why It Matters

This incident highlights a severe risk pattern in open-source AI orchestration tools: default configurations that expose powerful APIs without authentication or network restrictions. For AI practitioners and organizations deploying multi-agent systems, it underscores the critical need for secure-by-default designs, rigorous network segmentation, and proactive memory integrity checks—especially when systems handle sensitive credentials and influence long-term AI behavior.

Technical Details

• The vulnerability stems from Ruflo’s docker-compose.yml binding port 3001 to 0.0.0.0, exposing the MCP bridge to all network interfaces without authentication.
• Attackers can send an unauthenticated HTTP POST request to /mcp with a JSON-RPC payload invoking terminal_execute, granting full shell access inside the bridge container.
• Once compromised, attackers can extract environment variables containing LLM provider API keys, read all stored conversations from MongoDB, and inject malicious patterns into AgentDB’s learning-store to manipulate future AI outputs.
• The patch (v3.16.3) restricts the MCP bridge to localhost, adds server-side executeTool controls for terminal operations, and enables MongoDB authentication to prevent unauthorized data access.
• Affected components include the MCP bridge, AgentDB persistent memory store, and MongoDB database—all interconnected in the default deployment architecture.

Industry Insight

AI platform vendors must adopt zero-trust defaults for all network-facing services, especially those handling agent orchestration and memory persistence. Security teams should treat any exposure of tool invocation endpoints as high-risk and implement strict network policies, even for internal tools. Additionally, AI memory systems require cryptographic signing and audit trails to detect and prevent poisoning attacks, as persistent memory manipulation can lead to long-term, undetectable behavioral drift in deployed models.

TL;DR

• Ruflo 存在严重安全漏洞（CVE-2026-59726，CVSS 10.0），允许未认证攻击者远程执行命令并污染 AI 记忆。
• 漏洞源于 MCP 桥默认绑定到所有网络接口且无身份验证，暴露了 233 个工具包括终端执行和数据库操作。
• 攻击者可窃取 LLM API 密钥、读取用户对话、操纵 AI 行为并植入持久后门。
• 维护者在负责任披露后 24 小时内修复：默认绑定回环接口、限制终端执行、启用 MongoDB 认证。
• 受影响组织需立即关闭端口、轮换密钥、审计内存并重建容器。

为什么值得看

该事件揭示了当前主流 AI 编排平台在默认配置下的严重安全风险，尤其对依赖开源工具构建自主 Agent 系统的开发者具有警示意义。它凸显了“开箱即用”便利性与安全性之间的失衡，强调了在部署多 Agent 系统时必须实施最小权限原则和网络隔离。

技术解析

• 漏洞核心在于 docker-compose.yml 默认将 MCP 桥端口 3001 绑定至 0.0.0.0，且未启用任何认证机制，使外部网络可直接访问 /mcp 和 /mcp/:group 端点。
• 攻击者可通过发送特制 JSON-RPC 请求调用 tools/call 方法触发 ruflo__terminal_execute，从而在容器内获得 shell 权限。
• 成功入侵后，攻击者可从环境变量中提取 LLM 提供商 API 密钥，利用这些密钥创建受控 Agent 群，并向 AgentDB 学习存储注入恶意模式以长期操控 AI 输出。
• 修复方案包括：MCP 桥默认仅监听 localhost；对 terminal_execute 增加服务器端 executeTool 控制；强制开启 MongoDB 身份验证以防止数据泄露。
• NVD 官方描述确认该漏洞影响所有低于 3.16.3 版本，属于典型的安全配置错误与缺乏访问控制的组合缺陷。

行业启示

• AI 基础设施组件的默认配置应遵循“安全优先”设计哲学，避免将敏感服务直接暴露于公网，即使是在开发或测试环境中。
• 对于支持动态工具调用和持久记忆的 Agent 平台，必须引入细粒度的访问控制、操作审计与异常检测机制，防止被滥用为横向移动或数据窃取跳板。
• 安全响应不仅限于打补丁，还需包含凭证轮换、状态完整性校验与环境重建等纵深防御措施，特别是在涉及第三方 API 密钥和长期记忆存储的场景中。