Ruflo’s default docker-compose deployment left the MCP bridge POST /mcp and POST /mcp/:group endpoints open without authentication. An unauthenticated attacker can issue a tools/call to terminal_execute command, obtain a shell inside the bridge container, read stored provider API keys, and modify AgentDB learning-store patterns. The weakness is a lack of authentication coupled with command execution capabilities, enabling complete control over the container and exposure of sensitive credentials.

The vulnerability affects ruvnet:ruflo releases prior to 3.16.3. Any system running the default docker-compose deployment of Ruflo without additional access controls is susceptible.

The CVSS score of 10 signals maximum severity, yet the EPSS score of less than 1% indicates that actual exploitation is currently unlikely. The MCP bridge endpoints are exposed without authentication; therefore the most probable attack vector is any network path to these endpoints, as inferred from the description. The vulnerability is not listed in the CISA KEV catalog, so no active exploitation guidance exists. Although the flaw permits remote code execution with no extra privileges, the low EPSS suggests that it has not yet been widely exploited.