Why it matters
This is a maximum-severity (CVSS 10.0), unauthenticated remote code execution vulnerability in a widely-deployed agentic AI platform reachable directly over the network in default configurations. Beyond RCE, the flaw specifically enables 'AI memory poisoning' — corrupting the persistent memory/learning pipeline that agents rely on for context — which can persist malicious instructions across future agent sessions, a novel and severe agentic attack class.
Attack vector
Ruflo's MCP Bridge component exposed an unauthenticated POST /mcp endpoint on port 3001 (bound to 0.0.0.0 in default Docker deployments), exposing 233 MCP tools without authentication. An unauthenticated remote attacker could invoke terminal_execute to run arbitrary commands inside the bridge container, steal LLM API keys, read/poison agent conversation history stored in an unauthenticated MongoDB instance, and establish persistent backdoors across an enterprise's agent fleet.
Affected systems
Ruflo (open-source AI agent hosting platform) versions prior to 3.16.3
Mitigation
Upgrade to Ruflo 3.16.3 or later, which binds the MCP bridge to loopback by default, gates terminal_execute behind server-side controls, and enables MongoDB authentication. Restrict network access to MCP bridges, rotate all LLM API keys, and audit AgentDB/conversation stores for tampering.