TL;DR
Noma Labs found a critical (10 CVSS) vulnerability in Ruflo, an open source AI agent orchestration platform with more than 40,000 deployments. A single unauthenticated HTTP request to the MCP bridge lets an attacker register a malicious tool, escalate to administrator, and take control of every agent in the swarm.
What is Ruflo and How Does it Work?
Ruflo sits between your agents and the tools they call. It exposes a Model Context Protocol bridge that brokers every request, which makes it a convenient single point of integration and, as it turns out, a convenient single point of failure.
- A registry that stores every tool an agent is allowed to invoke
- A bridge process that translates MCP calls into vendor specific APIs
- A scheduler that fans work out across the agent swarm
The Shadow AI Risk
Most security teams have no inventory of which agents are running, who deployed them, or what credentials they hold. That gap is what turns a single bridge vulnerability into an enterprise wide incident.
An agent swarm is only as trustworthy as the weakest tool any one agent is allowed to call. Eli Ainhorn, Security Researcher at Noma
The RufRoot Discovery
The bridge accepted tool registration payloads without verifying the caller. A single POST was enough to plant a tool that every downstream agent would happily invoke.
- Register a tool that points at attacker controlled infrastructure
- Wait for any agent in the swarm to resolve the tool from the registry
- Inherit that agent’s credentials and escalate to the admin scope
Securing the MCP Layer
The bridge accepted tool registration payloads without verifying the caller. A single POST was enough to plant a tool that every downstream agent would happily invoke.
Take control of your agents
See how Noma discovers, governs and protects every AI agent across your enterprise.
