Bifrost AI Gateway Flaw Lets Unauthenticated Attackers Run Commands

A critical flaw in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers, lets an unauthenticated attacker run arbitrary commands on the gateway server with a single HTTP request.

Tracked as CVE-2026-90898 with a CVSS score of 9.8, it affects all versions of the Bifrost HTTP transport before 2.1.0 when management authentication is disabled - the default setup. A fix ships in transports/v2.1.0.

Yuval Moravchick of JFrog Security Research, who found the bug, said an attacker can register a stdio-type MCP client through one unauthenticated POST to the management API endpoint /api/mcp/client. Bifrost runs the specified command right away, before any MCP handshake, as the gateway process user - appuser on the official Docker image. Since the gateway stores API keys for every connected provider, command execution hands the attacker those credentials.

The stock binary binds the management API to localhost by default, limiting exposure to the local machine. The official Docker image binds to 0.0.0.0, making the API reachable from outside the container if the port is published.

Operators should upgrade to transports/v2.1.0, which returns 403 when an unauthenticated caller tries to register a stdio MCP client. Those who cannot upgrade should set governance.auth_config.is_enabled to true, use strong credentials, and keep the management listener off untrusted networks. JFrog advises treating any instance that ran with authentication disabled and the management API exposed as compromised, and rotating virtual keys and provider API keys.

Transports/v2.0.0 users remain affected by the MCP flaw; that release only fixed an earlier plugin vulnerability. The 1.6.x line through 1.6.11 contains neither fix.

A related flaw found by Or Peles of the same team was disclosed on September 6. CVE-2026-86242 (CVSS 8.1) lets an unauthenticated attacker register a custom plugin whose path is an HTTP URL. Bifrost downloads the file, writes it as a temporary shared object, and loads it via Go's plugin.Open. On dynamically linked builds the code runs as the gateway process user; on statically linked builds, including the official Docker image, plugin.Open fails and the result is server-side request forgery only. The fix is in transports/v2.0.0.

Both flaws stem from the same root cause: Bifrost's management API ships with authentication disabled by default. They are the second and third security issues disclosed in the project in under a month, after an unrelated SSRF flaw (CVE-2026-55245) fixed in late August.

The MCP flaw follows a pattern that has already led to real-world attacks. In April 2026, researchers disclosed a design flaw in MCP's STDIO transport affecting Anthropic's official SDKs. A similar command-injection flaw in LiteLLM, another AI gateway, was actively exploited and added to CISA's Known Exploited Vulnerabilities catalog in June. Neither Bifrost CVE appears in the KEV catalog as of publication.

Source: The Hackers News