RufRoot漏洞震撼Ruflo：4萬星AI Agent框架CVSS滿分10分 | RufRoot Flaw Hits Ruflo: 40K-Star AI Agent Tool Scores CVSS 10.0

7月 30, 2026

By Kit 小克 | AI Tool Observer | 2026-07-31

🇹🇼 RufRoot漏洞震撼Ruflo：4萬星AI Agent框架CVSS滿分10分

RufRoot（CVE-2026-59726）是資安公司 Noma Security 揭露的一個 CVSS 10.0 滿分漏洞，出現在擁有超過 4 萬顆 GitHub 星星的開源多代理協作框架 Ruflo（前身為 Claude Flow）中。這個專為 Claude Code 打造的 Agent 編排平台，因為預設把 MCP bridge（Model Context Protocol 橋接埠）開放在網路上、且完全不需要驗證，攻擊者只要送出一個 HTTP POST 請求到 3001 埠，就能在容器內取得完整程式碼執行權限。

問題出在哪：233 個工具，零驗證

Ruflo 透過這個未受保護的 MCP bridge，暴露了整整 233 個工具，涵蓋 shell 指令執行、資料庫操作、Agent 管理、記憶體儲存等敏感功能。也就是說，只要能連到這個埠，不需要帳號密碼，就能：

執行任意程式碼
竊取 LLM API 金鑰
讀取使用者的對話紀錄
劫持正在運作的 AI Agent
污染平台的持久化 AI 記憶（memory poisoning）

其中「記憶污染」特別值得注意——這代表攻擊者不只能偷資料，還能長期竄改 Agent 的判斷邏輯，影響後續所有互動，是一種相對新型態的 AI 供應鏈風險。

修復速度值得肯定

Noma Security 於 2026 年 6 月 30 日負責任揭露後，Ruflo 維護者 Reuven Cohen 在 24 小時內就發布了 v3.16.3 修補版本，把 MCP bridge 預設綁定改為僅限本機（loopback），並將 terminal_execute 等高風險工具加上伺服器端權限控管，同時啟用 MongoDB 驗證防止對話外洩。反應速度算業界少見的快。

對開發者的啟示

如果你有在用 Ruflo 或其他自架的 MCP 相關 Agent 工具，這件事的教訓很直接：預設值不能信任「網路上沒人會連到我」。任何本地開發用的服務埠，都應該預設綁定 loopback，對外開放前必須加上驗證層。這也再次提醒——多代理框架的攻擊面遠比單一 LLM API 呼叫大得多，233 個工具就是 233 個潛在入口。

好不好用，試了才知道。

🇺🇸 RufRoot Flaw Hits Ruflo: 40K-Star AI Agent Tool Scores CVSS 10.0

RufRoot (CVE-2026-59726) is a maximum-severity CVSS 10.0 flaw disclosed by Noma Security, found in Ruflo (formerly Claude Flow) - an open-source multi-agent orchestration framework for Claude Code with over 40,000 GitHub stars. The bug lived in Ruflo's MCP bridge, which was exposed to the network by default with zero authentication. A single unauthenticated HTTP POST to port 3001 was enough to get full code execution inside the container.

The Root Cause: 233 Tools, No Auth Wall

Through this unprotected MCP bridge, Ruflo exposed 233 tools - shell command execution, database operations, agent management, and persistent memory storage. Anyone who could reach that port, no credentials needed, could:

Execute arbitrary code
Steal LLM API keys
Read stored user conversations
Hijack running AI agents
Poison the platform's persistent AI memory

The memory-poisoning angle deserves special attention - it means an attacker doesn't just exfiltrate data once, they can quietly corrupt an agent's long-term reasoning, affecting every future interaction. That's a distinctly newer flavor of AI supply-chain risk beyond simple data theft.

A Fast Fix, To Its Credit

After Noma Security's responsible disclosure on June 30, 2026, Ruflo maintainer Reuven Cohen shipped v3.16.3 within 24 hours, binding the MCP bridge to loopback by default, gating high-risk tools like terminal_execute behind server-side access controls, and enabling MongoDB authentication to stop conversation theft. That turnaround is genuinely fast by industry standards.

What This Means If You Run MCP-Based Agents

If you self-host Ruflo or any similar MCP-based agent tooling, the lesson is blunt: never assume "nobody will connect to this port" as your security model. Any local dev service should default to loopback binding, with an explicit auth layer required before it's exposed. It's also a reminder that multi-agent frameworks have a much larger attack surface than a single LLM API call - 233 tools means 233 potential entry points.

好不好用，試了才知道。

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

搜尋此網誌

AI小貼士