Perfect 10: Ruflo AI Agent Platform Hit with CVSS 10.0 Zero-Auth Flaw — One Request Hijacks Everything

An AI agent orchestration platform with 67,000 GitHub stars was found to be one unauthenticated HTTP POST away from full container takeover — no token, no API key, no questions asked.

Three Key Takeaways

CVSS 10.0 — they call it RufRoot. Security firm Noma Labs discovered CVE-2026-59726 in Ruflo, an open-source AI agent orchestration platform. The flaw sits in Ruflo's MCP Bridge component, which exposes 233 tool endpoints over HTTP with absolutely zero authentication — no token, no API key, no IP allowlist. A single unauthenticated HTTP POST to port 3001 grants arbitrary shell execution inside the container. Noma Labs disclosed the vulnerability to Ruflo's maintainers on June 30 with a working proof of concept and went public on July 29.

API keys, chat logs, agent memory — all exposed. Exploiting the flaw, an attacker could steal every LLM API key stored on the platform (meaning your OpenAI or Anthropic bill could be run up by a stranger), read the full conversation history between users and AI, hijack running AI agents to execute malicious operations, and even tamper with the platform's persistent AI memory — poisoning every future conversation the agent has. Dark Reading reported the vulnerability could also be used to spawn rogue AI swarms.

Fast patch, but the blast radius may already be enormous. Ruflo's maintainers shipped a fix in version 3.16.3 within 24 hours of disclosure, and Noma independently confirmed the patch blocks the attack. But the catch: every instance running a pre-3.16.3 version with the old default Docker Compose config was vulnerable. For a project with 67,000 stars, the number of production deployments still running default configs and unpatched is a figure nobody wants to estimate.

WangDou's Take

Everyone is racing to wire AI agents into MCP, and 233 tools on an HTTP endpoint sounds impressively capable — until you realize all 233 doors are wide open without so much as a deadbolt. Sixty-seven thousand GitHub stars is not a quality certification; it is a measurement of attack surface. What makes this a true "perfect 10" is what happens after a breach: the attacker does not get one machine, they get a swarm of AI agents working for them. The MCP ecosystem is hot, but the "ship first, secure later" mindset has a habit of shipping straight into the CVE database.

Source: Noma Security, The Hacker News, Dark Reading