AIKIDO-2026-866750

TL;DR

The MCP bridge in ruflo exposes the POST /mcp and POST /mcp/:group endpoints without authentication, and the shipped docker-compose defaults bind the bridge and MongoDB to all network interfaces. An unauthenticated network attacker can call tools/call to reach terminal_execute and run arbitrary OS commands inside the bridge container, gaining a shell, reading provider API keys from the environment, and poisoning the AgentDB learning store. The terminal_execute blocklist is enforced only in the autopilot flow, so the primary MCP request paths bypass it. The fix binds the bridge to loopback by default, adds bearer-token authentication with constant-time comparison, and gates terminal_execute behind an explicit opt-in.