Loading story…
ruvnet fixed a critical unauthenticated remote code execution flaw in Ruflo's default docker-compose deployment, tracked as CVE-2026-59726 and GHSA-c4hm-4h84-2cf3. In versions before 3.16.3, the MCP bridge exposed POST /mcp and POST /mcp/:group without authentication, allowing a network attacker to invoke terminal execution and gain a shell in the bridge container. The issue carries a CVSS 9.8 rating and was mapped to CWE-78, CWE-306, and CWE-942.
The vendor said successful exploitation could expose provider API keys, let attackers spawn attacker-controlled swarms, and poison the AgentDB learning store to influence future AI outputs; the default deployment also exposed MongoDB on all interfaces. Ruflo v3.16.3 mitigates the risk by binding the MCP bridge to 127.0.0.1 by default, requiring MCP_AUTH_TOKEN for public binding, adding bearer authentication with constant-time comparison, gating terminal execution behind MCP_ENABLE_TERMINAL=true, making the bridge filesystem read-only, and enabling MongoDB authentication with a required MONGO_INITDB_ROOT_PASSWORD. Operators of previously exposed instances were urged to firewall ports 3001 and 27017, rotate provider API keys, and audit both AgentDB and MongoDB because redeployment alone may not remove prior tampering or poisoning.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The Ruflo MCP bridge vulnerability was published as CVE-2026-59726, affecting versions prior to 3.16.3 and describing unauthenticated access to POST /mcp and POST /mcp/:group endpoints. The advisory stated successful exploitation could yield shell access in the bridge container, exposure of provider API keys, and poisoning of AgentDB learning-store patterns.
Ruflo released version 3.16.3 as a security update addressing an unauthenticated remote code execution issue in the default docker-compose deployment's MCP bridge. The release changed the default bridge binding to 127.0.0.1, added authentication controls, gated terminal execution, and hardened MongoDB and container settings.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed multiple security flaws affecting AWS MCP components, including a local file inclusion bug in the AWS Remote MCP Server and a critical command injection issue in `aws-mcp-server`. Varonis said authenticated users could abuse AWS CLI shorthand syntax, specifically the `@=` operator passed through the `aws___call_aws` tool, to read arbitrary files from the underlying host even when `FileAccessMode=NO_ACCESS` was enabled. AWS assigned **CVE-2026-4270** to the file access restriction bypass and said the issue was fixed in `aws-api-mcp-server` version **1.3.9**; the exposure affected the public endpoint `aws-mcp.us-east-1.api.aws` as well as self-hosted or forked deployments. A separate flaw, tracked as **CVE-2026-5058** and published by Trend Micro's Zero Day Initiative as **ZDI-26-246**, allows unauthenticated remote code execution in `aws-mcp-server` because user-supplied input in the allowed-commands list is not properly validated before being used in a system call. ZDI rated the bug **CVSS 9.8** and said successful exploitation lets attackers run arbitrary code in the MCP server context; the advisory was released as a 0-day after the vendor rejected the report. The disclosures landed alongside another AWS bulletin for **CVE-2026-4269**, an improper S3 ownership verification issue in the Bedrock AgentCore Starter Toolkit, underscoring broader security concerns around MCP-related tooling and the need for immediate patching and review of derivative implementations.
Jun 29, 2026
Two critical vulnerabilities were disclosed that allow **unauthenticated remote code execution** against exposed systems. `CVE-2024-40711` affects **Veeam Backup & Recovery** and stems from **deserialization of untrusted data**, enabling remote compromise when an attacker can deliver a crafted payload to a vulnerable instance. The flaw puts backup infrastructure at particular risk because successful exploitation could give attackers direct access to systems designed to store and manage recovery data. A separate flaw, `GHSA-V6WJ-C83F-V46X`, impacts the `domain_lookup` module in **`@profullstack/mcp-server`** and is described as an **OS command injection** vulnerability with a **CVSS 9.8** rating. Exploitation allows attackers to execute commands with the privileges of the Node.js process, exposing source code, configuration files, environment variables, database credentials, and cryptographic keys, while also enabling persistence, malware deployment, service termination, and broader lateral movement. Together, the disclosures highlight continued risk from internet-exposed enterprise software and developer tooling that process untrusted input without adequate safeguards.
Jun 29, 2026
Flowise disclosed a critical remote code execution flaw, tracked as **`CVE-2026-56274`**, affecting versions before **`3.1.2`** in the Custom MCP Server feature. The vulnerability stems from multiple OS command injection paths in **`validateCommandFlags`** and **`validateArgsForLocalFileAccess`**, allowing attackers to configure a malicious MCP server and execute arbitrary commands on the Flowise host. The issue is rated **CVSS 9.9** and is remotely exploitable. Advisories describe three bypass techniques: an incomplete Docker argument blocklist that permits **`docker build`** with a remote URL, an **`npx`** blocklist bypass where **`--yes`** is allowed even though **`-y`** is blocked, and a Unix path validation weakness that lets paths beginning with **`//`** evade local file access checks for **`node`**. Exploitation requires any Flowise account role or API access with view and update permissions for chatflows. Organizations were urged to upgrade to **`Flowise 3.1.2`** or later, review MCP server configurations, and restrict chatflow management permissions.
Jun 29, 2026