Ruflo's MCP bridge: a CVSS 10.0 RCE that leaks your LLM API keys
1M active users, #2 on MCPMarket: one unauthenticated POST to port 3001 owns the box, harvests LLM keys, and poisons agent memory a patch can't clear.
Copy markdown
One POST request, full remote shell
An unauthenticated HTTP POST to port 3001's /mcp endpoint invokes the ruflo__terminal_execute tool, bypassing command blocklists for arbitrary code execution. The default docker-compose bound the bridge to 0.0.0.0, so any network-reachable instance — 233 exposed tools — was fully ownable.
It steals your keys and rewrites the agent's memory
Beyond code execution, attackers could harvest LLM API credentials, read stored conversations, and inject instructions into the platform's persistent AI memory to steer its answers for every future user. Researchers call that memory poisoning "patch-resistant" — a new class of risk that outlives the fix.
Upgrading to v3.16.3 is only step one
The patch binds the bridge to loopback, gates dangerous commands server-side, and turns on MongoDB auth — but it can't undo a breach. Rotate every LLM API key, close ports 3001 and 27017, audit the pattern store and MongoDB for injected entries, and rebuild containers from a clean image.
Why your other MCP bridges are on notice
Ruflo has ~10M downloads, ~1M active users, and ranked #2 on MCPMarket — but the root cause, an MCP bridge served over HTTP with no auth, is a common pattern. Treat every MCP bridge as an unauthenticated RCE surface until you have checked its bind address and authentication.