What happened
Noma Security (Noma Labs) discovered that Ruflo's MCP Bridge component, which handles all tool invocations for AI agent workflows (Codex/Claude Code hosting), was exposed without any authentication in the project's default Docker Compose configuration. A single HTTP request to the exposed bridge grants an attacker full code execution and access to agent secrets and memory.
Why it matters
This is a maximum-severity (CVSS 10.0) novel agent-execution attack class: unauthenticated exposure of an MCP tool-invocation bridge directly enables full agent takeover, LLM credential exfiltration, and persistent memory poisoning — a new incident-response category (memory poisoning) that traditional security tooling isn't built to detect or remediate.
Attack vector
A single unauthenticated HTTP POST request to the exposed MCP bridge /mcp endpoint (Express.js server on port 3001) allows an attacker to invoke any of 233 tool handlers, achieve remote code execution, steal LLM API keys, read stored user conversations, hijack running AI agents, and poison the agent's persistent memory store
Affected systems
Ruflo (formerly Claude Flow) AI agent orchestration platform, versions before 3.16.3
Mitigation
Upgrade to Ruflo 3.16.3+, which binds the bridge to loopback, gates terminal_execute behind access controls, and enables MongoDB authentication. Rotate all exposed LLM API keys and audit agent memory stores for poisoning. GHSA-c4hm-4h84-2cf3.