Critical Bifrost AI Gateway Flaw Allows Command Execution Without Credentials

Bifrost — an open-source AI gateway that distributes requests across more than 20 large language model providers — has a critical vulnerability. It lets an attacker with no credentials execute arbitrary commands on the gateway server through a single HTTP request.

The flaw is tracked as CVE-2026-90898 with a CVSS score of 9.8. It affects every version of the Bifrost HTTP transport before 2.1.0 when management authentication is disabled — which happens to be the default configuration. A fix ships in transports/v2.1.0.

How the attack works

Yuval Moravchick of JFrog Security Research, who found the issue, explains that an attacker can register an stdio-type MCP client with a single unauthenticated POST to the management API endpoint /api/mcp/client. Bifrost launches the specified command immediately — before any MCP handshake — as the user running the gateway process. In the official Docker image that user is appuser. Because the gateway stores API keys for every connected provider, running commands there also exposes those credentials.

The stock Bifrost binary binds the management API to localhost by default, limiting the risk to the local machine. The official Docker image, however, listens on 0.0.0.0, so publishing the port makes the API reachable from outside the container.

What to do

JFrog recommends upgrading to transports/v2.1.0, where an unauthenticated attempt to register an stdio MCP client now returns a 403. Those who cannot upgrade at once should enable governance.auth_config.is_enabled, set strong credentials, and keep the management listener off untrusted networks. Any instance that ran with authentication disabled and the management API exposed should be treated as compromised, with virtual keys and provider API keys rotated.

Release transports/v2.0.0 remains vulnerable to the MCP flaw: it fixed only an earlier plugin issue. The 1.6.x line through 1.6.11 contains neither fix.

A second flaw

A related vulnerability, CVE-2026-86242 (CVSS 8.1), found by Or Peles of the same team and disclosed on September 6, allows registration of a plugin whose path is an HTTP URL. Bifrost downloads the file, writes it as a temporary shared object, and loads it via plugin.Open. On dynamically linked builds the plugin's code runs as the gateway process user; on static builds (including the Docker image) plugin.Open fails and the result is only SSRF.

Both flaws share the same root cause: Bifrost's management API ships with authentication disabled by default. They are the second and third security issues in the project in under a month, following a separate SSRF flaw fixed in late August. A similar command-injection bug in the LiteLLM gateway was actively exploited and landed in CISA's catalog. As of publication, neither Bifrost CVE appears there.

Source: The Hacker News