Disclosed vulnerability
RufRoot: unauthenticated MCP bridge in Ruflo gives full RCE from a single HTTP request
AIR-2026-0172 AIR record · 2026-07-noma-rufroot-ruflo
From the supporting source
A single HTTP request was enough to gain full remote code execution inside a Ruflo deployment.prnewswire.com
The record
Disclosed
2026-07-29
Vendor
Ruflo
Product
Ruflo (open-source agent meta-harness, ~66k GitHub stars)
Risk domain
Access control and permissions › Credential theft
Also touches
Data and memory poisoning, Privilege escalation, Data exfiltration channels
System type
Generative model
Who acted
AI was the target — an unauthenticated MCP bridge gives RCE from one HTTP request
Attack surface
Agent framework
Autonomy level
Fully autonomous
Initial vector
Unauthenticated network request
Impact type
Remote code execution, Credential theft, Memory poisoning, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Default Ruflo deployments exposed on the network
Capability abused
Defense & remediation
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Ruflo shipped a locked-down default requiring explicit authentication within 24 hours
Taxonomy & references
Curator notes
CVSS 10.0. Disclosed 2026-06-30 with a PoC confirmed against a live default deployment. Primary source is Noma's own press release (the noma.security blog post is not used as the source here). Noma highlights persistent-memory tampering as the durable harm.
Supporting sources
Cite as
Enkrypt AI. "RufRoot: unauthenticated MCP bridge in Ruflo gives full RCE from a single HTTP request". AIR, AIR-2026-0172. https://agentincident.vercel.app/i/AIR-2026-0172/ (accessed 2026-10-19).