A Ruflo bug let one web message control agent servers
The bug has a score of 10.0 of 10 for severity, and the maintainer repaired it in 24 hours. No source reports an attack.
In June 2026, the company Noma Labs found a bug in Ruflo, an open-source platform for groups of AI agents. The default setup let a person on the network operate shell commands with one web message and no login. A CVE number, CVE-2026-59726, names the bug. The maintainer released version 3.16.3 in less than 24 hours.
How it works
Ruflo starts from a Docker setup, a packaged set of instructions for software. The default setup opened the tool bridge on port 3001 to all network interfaces and asked for no login. The bridge sends messages to 233 tools, and one tool operates shell commands.
The proof
Noma Labs did an attack in eight steps on a default install on AWS and confirmed each step live. The attacker could:
- read all AI provider keys in the environment
- dump all stored conversations
- start agent swarms that the victim must pay for
- write an incorrect rule into the agent memory
What is not known
No source reports an attack in the wild. The risk is set by the firewall and the network around the install. The repair changes the defaults, but it does not remove an incorrect entry in the memory.
Insight: The weak point is the tools, not the model
In CoreBreak, attackers sent a tool command that went around all model checks on 3 agent platforms. In Ruflo, one message got to 233 tools with no model check. An incorrect memory entry changed the answers after that. Guardrails around the model do not stop an attack on the tools, and the tools are where attackers get control. Check where each vendor applies its checks.
Sources
Posted
