Patching This CVSS 10.0 Flaw Does Not Undo What an Attacker Already Taught Your Agent

Noma Labs published its research on 29 July into a vulnerability it calls RufRoot — CVE-2026-59726 — in the MCP bridge shipped with Ruflo, an agent meta-harness with roughly 66,000 GitHub stars, formerly named Claude Flow. GitHub, acting as CNA, scored it 10.0. The NVD has not yet issued a score of its own.

The chain

A single unauthenticated HTTP POST to /mcp on port 3001 reaches tools/call, which reaches terminal_execute, which is a shell. From there: provider API keys out of the environment, and write access to the agent's stored knowledge. The default Docker Compose configuration served 233 distinct tools over that interface — shell execution, database operations, agent lifecycle management, memory storage. The command blocklist existed only in autopilot flows, leaving the POST endpoints unguarded.

Already fixed — four weeks ago

This is not a zero-day. Noma disclosed privately on 30 June; version 3.16.3 shipped within about a day, on 1 July, and the CVE was published on 9 July. The patched bridge binds to localhost, requires an auth token or refuses to start, and makes terminal execution opt-in.

The part that survives the patch

This is the genuinely new finding. Attackers could poison patterns in the AgentDB learning store — and upgrading does not remove them. A deployment compromised before the fix keeps serving tampered agent behaviour afterwards, from a version that reports itself as patched. Remediation therefore means rotating credentials and auditing or purging stored knowledge, not just bumping the version.

Scope

No exploitation in the wild has been observed, and no count of exposed instances has been published.