CVE-2026-59726: Unauthenticated RCE in ruflo MCP bridge default docker-compose deployment
CVE-2026-59726 is verified against ruflo · npm affected versions: < 3.16.3 fixed version: 3.16.3 vulnerability class: RCE This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00315.
pruva-verify REPRO-2026-00315 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00315/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh The ruflo MCP bridge shipping in docker-compose defaults exposes POST /mcp with no authentication and binds the bridge and MongoDB to all interfaces. An unauthenticated network attacker can invoke tools/call -> terminal_execute inside the bridge container, obtain a shell as node, read provider API keys from the container environment, spawn attacker-controlled swarms on victim keys, and persist poisoned patterns into AgentDB that may steer future AI outputs. The vulnerable blocklist for terminal_execute was enforced only in the autopilot flow; POST /mcp and POST /mcp/:group bypass it. Reproduction should focus on the default docker-compose deployment and the MCP bridge request flow.
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.