- A critical unauthenticated remote code execution vulnerability (CVE-2026-90898, CVSS 9.8) affects all versions of the open-source AI gateway Bifrost before 2.1.0.
- A second flaw (CVE-2026-86242, CVSS 8.1) allows arbitrary code execution via custom plugin registration on dynamically linked builds.
- Both vulnerabilities originate from authentication being disabled by default on the management API; fixes are available in recent releases, and operators are urged to rotate exposed credentials.
A critical vulnerability in the open-source AI gateway Bifrost allows an unauthenticated attacker to execute arbitrary commands on the gateway server with a single HTTP request. The flaw, tracked as CVE-2026-90898 and rated 9.8 on the CVSS scale, affects all versions before 2.1.0 when management authentication is disabled—the default configuration.
Yuval Moravchick of JFrog Security Research discovered that an attacker can register a stdio-type MCP client through a single unauthenticated POST to the management API endpoint. Bifrost starts the specified command immediately before any MCP handshake, running as the gateway process user.
On the official Docker image, that user is appuser, and the gateway stores API keys for every connected provider, granting attackers access to those credentials. The official Docker image binds the management API to 0.0.0.0, making it reachable from outside the container if the port is published. Operators should upgrade to transports/v2.1.0, which returns 403 for unauthenticated MCP client registration. Those unable to upgrade immediately should enable authentication and use strong credentials.
A second related flaw, CVE-2026-86242 (CVSS 8.1), was disclosed on September 6 by Or Peles of the same research team. It allows an unauthenticated attacker to register a custom plugin via an HTTP URL; on dynamically linked builds, Bifrost downloads and loads the plugin, executing its code as the gateway user. The fix is in transports/v2.0.0.
Both flaws share the same root cause: Bifrost’s management API ships with authentication disabled by default. They follow a pattern of similar attacks against MCP and other AI gateways like LiteLLM, which was actively exploited and added to CISA’s Known Exploited Vulnerabilities catalog in June. Neither Bifrost CVE appears in that catalog as of publication.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
