Overview
- Noma Labs disclosed a proof-of-concept on June 30, 2026 showing an unauthenticated POST to Ruflo's MCP bridge could run commands in the bridge container and list 233 tools.
- A single request to the exposed /mcp endpoint on port 3001 could let an attacker steal LLM provider API keys, dump conversations from the local MongoDB and spawn attacker-controlled agent swarms.
- Ruflo maintainers released version 3.16.3 within about 24 hours to bind the MCP bridge to localhost, restrict terminal_execute calls and enable MongoDB authentication, and the fix was independently confirmed to block the PoC.
- Patching stops further unauthorised access but does not remove malicious entries already written to AgentDB, so operators must assume exposed instances may be contaminated until they rebuild from clean images and audit stored memory.
- Immediate actions for exposed deployments are to close ports 3001 and 27017, rotate all LLM/provider keys, rebuild containers from known-good images and inspect AgentDB and MongoDB for injected patterns or unexpected agent activity.