Ruflo, the 66K-Star Open-Source Claude Agent Platform, Had a CVSS 10.0 Hole Anyone Could Walk Through — And Patching It Doesn't Undo the Damage

On July 29, 2026, security researchers at Noma Labs disclosed RufRoot — a maximum-severity vulnerability, tracked as CVE-2026-59726 with a CVSS score of 10.0, in Ruflo, the open-source multi-agent orchestration platform built on top of Claude Code. Ruflo isn't a niche project: formerly known as Claude Flow, it carries more than 66,000 GitHub stars and is widely described as the most-adopted open-source agent orchestration framework of 2026. The flaw let anyone who could reach a Ruflo deployment's network run arbitrary commands, steal LLM API keys, and rewrite the platform's persistent memory — no login required. The maintainer shipped a fix within 24 hours of disclosure, but researchers say the patch alone doesn't undo what a pre-patch attacker could have already planted.

What Ruflo Is, and Why 66,000 Stars Made This Urgent

Ruflo lets teams deploy dozens to hundreds of specialized Claude Code agents — researcher, coder, reviewer, tester — that coordinate through hierarchical, mesh, or adaptive topologies, share a persistent memory store called AgentDB, and communicate across machines. It markets itself on aggressive numbers: an 84.8% SWE-bench solve rate and roughly 75% lower API costs than running Claude Code directly, credited to its swarm coordination and caching. Those numbers, plus a permissive open-source license, made it the default choice for teams building multi-agent Claude Code workflows in 2026 — ranked #2 on MCPMarket and installed widely enough that a flaw in its core networking layer put a meaningful slice of the self-hosted agent ecosystem at risk at once.

The Bug: One POST Request, Zero Authentication, Root Inside the Container

The vulnerability lives in Ruflo's MCP Bridge, an Express.js server that brokers every Model Context Protocol tool call the platform's agents make. Noma Labs found that the bridge exposed 233 internal tools — including shell command execution, database operations, agent management, and direct writes to AgentDB — over plain HTTP with no authentication whatsoever. No API token, no session cookie, no header check, no IP allowlist. A single unauthenticated HTTP POST request to port 3001 was enough to get full command execution inside the container. In a default deployment, that port is reachable the moment Ruflo is exposed to a network — which is precisely how most self-hosted instances get set up.

Why RufRoot Is 'Patch-Resistant': Memory Poisoning Outlives the Fix

What separates RufRoot from an ordinary RCE bug is what an attacker could do with that access before anyone patched. Because the exposed tools included direct writes to AgentDB — the persistent memory Ruflo's agents use to store context and coordinate across sessions — an attacker could implant malicious instructions straight into the platform's long-term memory. Noma Labs put it bluntly: the ability to write into a platform's persistent AI memory means an attacker can influence what the AI tells every future user, long after the original intrusion ends. Upgrading the software closes the hole that let the attacker in; it does nothing to remove instructions the attacker already left behind.

The Fix — and What a Version Bump Alone Doesn't Cover

Following responsible disclosure, Ruflo's maintainer shipped version 3.16.3 within 24 hours, which changes the platform's defaults rather than just patching the auth check: the MCP Bridge now binds to the loopback interface instead of listening on all network interfaces, the terminal_execute tool is gated behind proper server-side access controls, and MongoDB authentication is enabled out of the box. Public network exposure is now something an operator has to explicitly opt into and secure, not the shipped default. Noma Labs' advisory is explicit that upgrading is necessary but not sufficient: any team that ran an internet-facing Ruflo instance before 3.16.3 needs to separately audit AgentDB for planted entries, because a clean redeploy on a poisoned memory store just means the poisoning survives with a patched version number attached to it.

The Bigger Pattern: MCP Bridges Are Becoming a New Attack Surface

This lands three days after Anthropic shipped its biggest MCP spec rewrite since launch, replacing stateful sessions with a stateless core and hardened, standardized auth specifically to close the kind of gap RufRoot exploited. Ruflo is a strong illustration of why that rewrite mattered: a tool built for developer convenience — spin up a swarm, point it at Claude Code, let agents talk to each other over HTTP — shipped with its most powerful internal interface open to the network by default, because nobody expected 233 tools' worth of shell and database access to sit one unauthenticated request away from anyone who could reach the port. Ruflo is not an outlier; it is the most popular example of a pattern across the fast-growing agent orchestration ecosystem, where bridges and gateways default to open rather than closed.

What This Means for Developers and AI Engineers

If you run Ruflo, or anything like it, the checklist is concrete. First, upgrade to 3.16.3 or later immediately and confirm the MCP Bridge is actually bound to loopback, not just documented as configurable that way. Second, treat AgentDB — or any persistent memory store your agents share — as a security boundary with the same scrutiny as a production database, and audit it for anomalous entries if you ever ran an exposed pre-patch instance. Third, before deploying any self-hosted MCP bridge or agent gateway, check what's actually listening on the network and whether authentication is enforced by default, not just available as an option nobody turns on. Popularity and GitHub stars are not a proxy for a secure-by-default network posture — RufRoot proves the two can be completely uncorrelated.

Bottom Line

A maximum-severity, CVSS 10.0 vulnerability in Ruflo — the most widely adopted open-source Claude Code agent orchestration platform — let anyone with network access run commands, steal API keys, and poison persistent AI memory with a single unauthenticated HTTP request. The maintainer's 24-hour turnaround and hardened defaults in v3.16.3 are a genuinely good response, but the fix only closes the door going forward: teams that were exposed before the patch have to separately hunt for planted instructions in their agent memory, because upgrading a version number does not undo what an attacker already wrote. As agent orchestration tools scale into de facto infrastructure, RufRoot is a preview of what happens when a convenience-first default meets a production-scale install base.