Affected Systems
Ruflo (open-source AI agent orchestration platform for Anthropic Claude and OpenAI Codex), all versions before 3.16.3. Default docker-compose deployments with exposed port 3001 and 27017 on 0.0.0.0 are vulnerable. Over 66,500 GitHub stars indicate wide adoption.
Exploitation Status
Proof-of-concept publicly available. Simple unauthenticated HTTP POST request achieves RCE. No evidence of active exploitation mentioned, but trivial exploit complexity (CVSS 10.0) makes weaponization highly likely.
Business Impact
Unauthenticated attackers can execute arbitrary commands in Ruflo containers, steal LLM API keys (Anthropic Claude, OpenAI) from environment variables, harvest all stored user conversations from MongoDB, poison AI memory (AgentDB learning-store) to manipulate future model outputs, and deploy persistent backdoors. Organizations face credential compromise, data exfiltration, AI behavior manipulation, and potential downstream attacks using stolen API keys. Exposure depends on firewall rules and network segmentation; internet-facing instances are fully exploitable.
Urgency
🔴 Immediate
Recommended Actions
- Upgrade Ruflo to version 3.16.3 or later immediately; patch binds MCP bridge to loopback, gates terminal_execute, and enables MongoDB authentication
- Block inbound access to TCP ports 3001 (MCP bridge) and 27017 (MongoDB) at firewall for all existing Ruflo deployments
- Rotate all Anthropic Claude and OpenAI API keys used by Ruflo instances; treat credentials as compromised if instance was network-reachable
- Audit AgentDB pattern store for malicious agentdb_pattern-store entries injected between deployment and patching; remove suspicious patterns
- Review MongoDB logs and data for unauthorized access or tampering; rebuild containers from clean images if compromise suspected