CVE-2026-59726: CVSS 10.0 Flaw in Ruflo Lets Attackers Seize AI Agents, Steal Credentials, and Poison Agent Memory Through a Single HTTP Request
Source
Critical Ruflo flaw lets attackers hijack AI agents through exposed MCP bridgeNoma Security / CSO Online
What happened
Noma Security published a full attack chain demonstration showing that the Ruflo open-source AI agent platform exposes its MCP Bridge component without any authentication in default configurations. The research, published on July 30 2026, documents CVE-2026-59726, which carries a CVSS score of 10.0. The researchers demonstrated the exploit against a standard AWS EC2 deployment, showing that a single unauthenticated HTTP request is sufficient to gain full access to the agent environment, execute arbitrary code, extract LLM API keys, and inject malicious content into the agent's persistent memory store. Memory poisoning is particularly consequential because it can silently corrupt the knowledge and instructions that an AI agent draws on across future sessions, making the effects of a successful attack durable and difficult to detect after the fact. The finding extends concerns already raised by related MCP security research, including ANSI escape injection vulnerabilities in MCP servers that can corrupt audit logs, and fits a pattern of authentication gaps appearing across AI orchestration platforms broadly. Affected organizations using Ruflo need to implement firewall controls immediately, rotate all exposed credentials, and audit agent memory for signs of manipulation.
Why it matters
- ·A CVSS 10.0 rating means no authentication barrier exists between an external attacker and full control of the agent environment, making this a maximum-severity incident for any organization with Ruflo deployed in an internet-reachable configuration. Compliance teams must treat exposed deployments as presumed compromised until remediation is confirmed.
- ·AI memory poisoning introduces a governance risk that standard incident response playbooks were not designed to handle: because the corrupted knowledge persists across sessions, the timeline of affected agent outputs may extend weeks or months before and after discovery, complicating breach scope determination and any mandatory disclosure analysis. Controls such as OWASP Top 10 for Large Language Model Applications surface this vector, but most enterprise IR plans lack specific procedures for auditing and restoring agent memory stores.
- ·The credential theft vector creates a downstream risk that reaches beyond Ruflo itself. Stolen LLM API keys may grant attackers access to production AI services, billing accounts, and any systems integrated through those credentials, meaning the blast radius of a successful exploit is not bounded by the Ruflo deployment alone.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Audit all Ruflo deployments immediately to determine whether the MCP Bridge port is internet-reachable or accessible from untrusted network segments, and apply firewall rules to restrict access while patching is arranged.
- ☐Rotate every LLM API key, service credential, and integration token that was accessible from any Ruflo instance that may have been exposed, treating them as compromised regardless of whether exfiltration evidence exists.
- ☐Conduct a manual forensic review of all persistent agent memory stores connected to affected Ruflo instances, looking for injected instructions, altered tool definitions, or anomalous content that could affect future agent behavior.
- ☐Expand your AI incident response playbook to include a specific procedure for AI memory poisoning: define how to snapshot, audit, and if necessary wipe and restore agent memory, and assign ownership of that procedure to a named role.
- ☐Extend your open-source AI component intake policy to require network exposure and authentication posture review before deployment, not only license and model quality checks, for any AI orchestration platform including agent frameworks.
What to watch next
Security researchers and the broader AI security community are likely to examine other open-source AI agent and MCP-compatible orchestration platforms for similar authentication gaps now that a full attack chain has been publicly demonstrated. Compliance teams should expect additional CVEs in this category and monitor vendor advisories for any platforms in their agent stack. Regulatory bodies with existing AI security guidance, including those developing requirements under frameworks such as the EU Cyber Resilience Act, may cite incidents of this severity when calibrating mandatory security requirements for AI systems. The pattern of MCP-layer vulnerabilities is also likely to attract scrutiny from enterprise insurers assessing AI-related cyber coverage, which could affect policy renewal terms for organizations with broad agentic deployments.