Bifrost AI Gateway flaw lets attackers run commands without credentials

September 22, 2026 at 09:41 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

A critical vulnerability in Bifrost, an open-source AI gateway, allows unauthenticated attackers to execute arbitrary commands on the server with a single HTTP request. The flaw, CVE-2026-90898 with a CVSS score of 9.8, affects all versions before 2.1.0 when management authentication is disabled, the default setting. A fix is available in transports/v2.1.0.

Key Facts

CVE-2026-90898 has a CVSS score of 9.8 and affects all Bifrost HTTP transport versions before 2.1.0 when management authentication is disabled.
An attacker can register a stdio-type MCP client via a single unauthenticated POST to /api/mcp/client, causing Bifrost to execute the specified command immediately.
The official Docker image binds the management API to 0.0.0.0, making it reachable from outside the container if the port is published.
JFrog advises treating any instance that ran with authentication disabled and the management API exposed as compromised, and rotating virtual keys and provider API keys.
A second flaw, CVE-2026-86242 with CVSS 8.1, allows unauthenticated registration of a custom plugin from an HTTP URL, leading to code execution on dynamically linked builds.

Vulnerability Details

The flaw, tracked as CVE-2026-90898, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request. Yuval Moravchick of JFrog Security Research discovered that an attacker can register a stdio-type MCP client through a single unauthenticated POST to the management API endpoint /api/mcp/client. Bifrost starts the specified command immediately, before any MCP handshake, as the gateway process user. On the official Docker image, that user is appuser, and because the gateway stores API keys for every connected provider, executing commands grants access to those credentials.

Exposure and Mitigation

The stock Bifrost binary binds the management API to localhost by default, limiting exposure to the local machine. The official Docker image binds to 0.0.0.0, making the management API reachable from outside the container if the port is published. Operators should upgrade to transports/v2.1.0, which returns 403 when an unauthenticated caller tries to register a stdio MCP client. Those who cannot upgrade immediately should set governance.auth_config.is_enabled to true, use strong credentials, and keep the management listener off untrusted networks. JFrog advises treating any instance that ran with authentication disabled and the management API exposed as compromised, and rotating virtual keys and provider API keys.

Related Plugin Flaw

A second, related flaw found by Or Peles of the same research team was disclosed on September 6. CVE-2026-86242 with CVSS score 8.1 allows an unauthenticated attacker to register a custom plugin whose path is an HTTP URL. Bifrost downloads the file, writes it as a temporary shared object, and loads it through Go's plugin.Open function. On dynamically linked builds, which Bifrost requires for custom Go plugins, the plugin loads and its code runs as the gateway process user. On statically linked builds, including the official Docker image, plugin.Open fails and the result is server-side request forgery only.