Ruflo patched versions before 3.16.3 after Noma Security showed a single unauthenticated HTTP request could seize control of default enterprise deployments through the platform’s MCP bridge.
The exposed /mcp endpoint let attackers invoke 233 tools—including shell, database and memory functions—to run code, steal LLM API keys, read conversations and deploy rogue agent swarms.
Noma said the fix binds the MCP bridge to loopback by default and fails closed if admins try to expose it publicly without authentication.
Ports 3001 and 27017 should be closed immediately, and users should rotate LLM keys, inspect MongoDB and audit AgentDB because patched redeployments do not remove memory poisoning.
The researchers and outside experts said the flaw underscores a wider MCP security gap as AI orchestration platforms increasingly expose privileged tools and persistent memory without strong authentication.