Loading story…
A critical vulnerability in the open-source AI agent orchestration platform Ruflo allowed unauthenticated remote code execution on exposed deployments, letting attackers send a crafted HTTP POST request to the /mcp endpoint and execute commands through the platform’s Model Context Protocol bridge. Tracked as CVE-2026-59726 and dubbed RufRoot, the flaw affected Ruflo versions before 3.16.3 and was tied to the project’s previous default Docker Compose setup, which exposed the MCP bridge on port 3001 without authentication and often left MongoDB on port 27017 accessible as well.
Researchers said successful exploitation could provide shell access, theft of AI provider API keys, harvesting of stored conversations, and tampering with AgentDB, Ruflo’s persistent memory store, enabling malicious instructions and behavioral changes that could survive patching. Ruflo released fixes within 24 hours of disclosure, including localhost-only binding by default, authentication requirements, restricted terminal execution, MongoDB authentication, and container hardening; administrators were urged to upgrade to 3.16.3, close exposed ports, rotate credentials, inspect logs and databases for tampering, review AgentDB for poisoning, and rebuild containers from clean images.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers from Noma Labs notified Ruflo maintainers about the critical unauthenticated RCE vulnerability CVE-2026-59726, dubbed RufRoot. The flaw affected Ruflo deployments exposing the MCP bridge without authentication.
Within 24 hours of disclosure, Ruflo released a fix for the RufRoot vulnerability, later identified as version 3.16.3. The patch locked down public exposure by default and added protections such as localhost-only binding, authentication, and restrictions on terminal execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
8 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcehackread.com
Open sourcedarkreading.com
Open sourcenoma.security
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ruvnet fixed a critical unauthenticated remote code execution flaw in **Ruflo**'s default `docker-compose` deployment, tracked as **`CVE-2026-59726`** and **`GHSA-c4hm-4h84-2cf3`**. In versions before **`3.16.3`**, the MCP bridge exposed `POST /mcp` and `POST /mcp/:group` without authentication, allowing a network attacker to invoke terminal execution and gain a shell in the bridge container. The issue carries a **CVSS 9.8** rating and was mapped to **`CWE-78`**, **`CWE-306`**, and **`CWE-942`**. The vendor said successful exploitation could expose provider API keys, let attackers spawn attacker-controlled swarms, and poison the **AgentDB** learning store to influence future AI outputs; the default deployment also exposed MongoDB on all interfaces. Ruflo **`v3.16.3`** mitigates the risk by binding the MCP bridge to `127.0.0.1` by default, requiring **`MCP_AUTH_TOKEN`** for public binding, adding bearer authentication with constant-time comparison, gating terminal execution behind **`MCP_ENABLE_TERMINAL=true`**, making the bridge filesystem read-only, and enabling MongoDB authentication with a required **`MONGO_INITDB_ROOT_PASSWORD`**. Operators of previously exposed instances were urged to firewall ports `3001` and `27017`, rotate provider API keys, and audit both AgentDB and MongoDB because redeployment alone may not remove prior tampering or poisoning.
Jul 10, 2026
Collibra disclosed two critical vulnerabilities in the **Collibra Platform Agent** that can be chained to achieve unauthenticated remote code execution in enterprise data management environments. The issues, tracked as `CVE-2026-10622` and `CVE-2026-10621`, affect the agent's exposed REST functionality and archive extraction process. According to the advisory and CERT/CC note `VU#873170`, the first flaw allows access to privileged `/rest/*` endpoints without proper authentication or authorization, while the second is a **Zip Slip** path traversal bug that can write files outside intended directories. An attacker could use the exposed REST endpoints to map the file system and then exploit the archive extraction flaw to place a malicious JSP web shell in a web-accessible location, potentially leading to arbitrary code execution as **root**. The risk is heightened because the agent may bind to all network interfaces and could be reachable from the public internet. Collibra released fixes for SaaS and self-hosted deployments, advised on-premises customers to upgrade to versions **2026.03** or **2025.10**, and recommended restricting REST interface exposure to trusted networks and monitoring logs for unauthorized script execution.
Jun 29, 2026
A critical remote code execution flaw, **`CVE-2026-61447`**, was disclosed in the PraisonAI AI agent framework, affecting versions before **`1.6.78`**. The vulnerability lies in **`CodeAgent._execute_python()`**, which executes LLM-generated Python without AST validation, import restrictions, or sandbox enforcement, allowing attackers to use prompt injection to make the agent run arbitrary code on the host. The issue received the maximum severity rating of **CVSS 10.0** under both v3.1 and v4.0. Successful exploitation can result in full host compromise and theft of sensitive data, including API keys, cloud credentials, database passwords, and other environment secrets, with potential pivoting into connected services. PraisonAI **`1.6.78`** fixes the issue, and defenders are being urged to upgrade immediately, reduce network exposure, rotate potentially exposed secrets, and monitor for anomalous outbound connections; no confirmed in-the-wild exploitation had been reported at disclosure time.
Jul 11, 2026