'RufRoot' Flaw Exposes AI Agent Platforms to Memory Poisoning — Even After Patching

Critical vulnerability in Ruflo AI platform allows remote code execution; fix issued in 3.16.3. Ensure security with credential rotation and memory audits.

By Content Team

Jul 30, 2026

ON THIS PAGE

A critical vulnerability in Ruflo — an open source AI agent orchestration platform, formerly Claude Flow, with around 10 million downloads — earned a perfect CVSS score of 10. Researchers at Noma Labs found that a single unauthenticated HTTP request could grant full remote code execution, exposing API keys, stored conversations and shell access.

The weak point was Ruflo's MCP bridge, which served 233 tools with no authentication at all — including terminal execution — while the default docker-compose config bound port 3001 to every network interface.

What makes CVE-2026-59726 especially alarming: attackers can poison the AI's memory, planting instructions that manipulate future responses long after they've left the system. A patch alone won't fix that.

Ruflo pushed a fix within 24 hours of disclosure on June 30, in version 3.16.3 — everything earlier is affected. Affected organizations should close ports 3001 and 27017, rotate AI provider credentials, audit platform memory for tampering, and rebuild containers from scratch.

Source: Dark Reading

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?