Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN812
_____________________________________________________________________

DATE                : 04/08/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running ruflo (npm) versions prior to
                                        3.16.3.
 
=====================================================================
https://github.com/ruvnet/ruflo/security/advisories/GHSA-c4hm-4h84-2cf3
_____________________________________________________________________


Unauthenticated RCE in ruflo MCP bridge default docker-compose
deployment

Critical
ruvnet published GHSA-c4hm-4h84-2cf3 on Jul 1

Package
ruflo (npm)

Affected versions
< 3.16.3

Patched versions
3.16.3


Description

The MCP bridge shipping in ruflo/docker-compose.yml exposed POST /mcp
with no authentication. The docker-compose defaults bound the bridge
and MongoDB to all interfaces. Combined, an unauthenticated network
attacker could invoke tools/call → terminal_execute inside the bridge
container, obtain a shell as node (uid 1000), read every provider
API key from the container env, spawn attacker-controlled swarms on
the victim's keys, and persist a poisoned pattern into the AgentDB
learning store that steers future AI outputs for all users of the
instance.

The tool blocklist that mentions terminal_execute was enforced only
in the autopilot flow. POST /mcp and POST /mcp/:group bypassed it.

Fixed in ADR-166 Phase 1-3 (branch security/adr-166-mcp-bridge-rce,
PR #2521):

    Bind loopback by default; fail-closed on public-bind opt-in
without MCP_AUTH_TOKEN
    Bearer auth middleware (timingSafeEqual constant-time compare)
    Server-side executeTool gate for terminal_execute
(MCP_ENABLE_TERMINAL=true opt-in)
    MongoDB --auth on by default; MONGO_INITDB_ROOT_PASSWORD
required to boot
    read_only container + tmpfs
    CORS allowlist wiring
    CI regression locks (static + runtime + compose defaults)

Operators of any exposed instance MUST:

    Firewall :3001 and :27017 immediately
    Rotate OPENAI / GOOGLE / OPENROUTER / ANTHROPIC keys
    Audit the AgentDB pattern store for injected
agentdb_pattern-store entries; purge poisoned patterns. A
patched redeploy alone does NOT undo poisoning.
    Audit MongoDB for tampering

Credit: Eli Ainhorn, Senior AI Vulnerability Researcher
@ Noma Security

Reviewed by Dragan Spiridonov (ADR-166 co-author).


Severity
Critical
10.0/ 10

CVSS v3 base metrics
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE ID
CVE-2026-59726

Weaknesses
Weakness CWE-78
Weakness CWE-306
Weakness CWE-942


Credits

    @ruvnet ruvnet Coordinator


=========================================================

+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================