Bifrost AI Gateway Flaw Allows Unauthenticated Commands

A critical security flaw in Bifrost, an open-source AI gateway that routes requests to more than 20 large language model (LLM) providers, lets an unauthenticated attacker run arbitrary commands on the gateway server with a single HTTP request. The vulnerability is tracked as CVE-2026-90898 and carries a CVSS score of 9.8, the highest severity range on the 0 to 10 scale. It affects all versions of the Bifrost HTTP transport before 2.1.0 when management authentication is disabled, which is the default configuration. JFrog Security Research, whose researcher Yuval Moravchick discovered the flaw, reports that a fix is available in transports/v2.1.0.

The researcher explains that an attacker can register a stdio-type MCP client through a single unauthenticated POST request to the management API endpoint /api/mcp/client. The management API is the control interface used to configure the gateway. MCP, a protocol for connecting AI assistants to external tools and data, uses a stdio client that runs as a local command. Bifrost starts the specified command immediately, before any MCP handshake, as the gateway process user. On the official Docker image, that user is appuser. Because the gateway stores API keys for every connected provider, executing commands on the gateway process grants the attacker access to those credentials.

Exposure depends on how the software is deployed. The stock Bifrost binary binds the management API to localhost by default, which means it listens only on the local machine. The official Docker image, however, binds to 0.0.0.0, making the management API reachable from outside the container if the port is published. A Docker image is a prepackaged version of the software that runs in a container, and the official image is a common way to run Bifrost. As a result, many deployments using the official image may expose the vulnerable endpoint to the internet without realizing it.

Operators should upgrade to transports/v2.1.0, which returns a 403 error when an unauthenticated caller tries to register a stdio MCP client. Those who cannot upgrade immediately should set governance.auth_config.is_enabled to true, use strong credentials, and keep the management listener off untrusted networks. JFrog advises treating any instance that ran with authentication disabled and the management API exposed as compromised, and rotating virtual keys and provider API keys. Operators on transports/v2.0.0 are still affected by the MCP flaw. That release fixed only an earlier plugin vulnerability and does not block the unauthenticated registration. The 1.6.x line through 1.6.11 contains neither fix.

A second, related flaw found by Or Peles of the same JFrog Security Research team was disclosed on September 6. CVE-2026-86242, rated 8.1 on the CVSS scale, allows an unauthenticated attacker to register a custom plugin whose path is an HTTP URL. A plugin is a small add-on that extends the software's abilities. Bifrost downloads the file, writes it as a temporary shared object, and loads it through Go's plugin.Open function. On dynamically linked builds, which Bifrost requires for custom Go plugins, the plugin loads and its code runs as the gateway process user. On statically linked builds, including the official Docker image, plugin.Open fails and the result is server-side request forgery only. The fix for this issue is in transports/v2.0.0.

Both flaws share the same root cause: Bifrost's management API ships with authentication disabled by default. They are the second and third security issues disclosed in the project in under a month, after an unrelated SSRF flaw tracked as CVE-2026-55245 that was fixed in late August. SSRF, or server-side request forgery, is a trick that makes a server perform unintended internal requests. The MCP flaw follows a pattern that has already led to real-world attacks. In April 2026, researchers disclosed a design flaw in MCP's STDIO transport that affects Anthropic's official SDKs. A similar command-injection flaw in LiteLLM, another AI gateway, was actively exploited and added to CISA's Known Exploited Vulnerabilities catalog in June. Neither Bifrost CVE appears in the KEV catalog as of publication.

For teams that run self-hosted AI gateways or other internet-facing infrastructure, AEU-I offers security-first IT and infrastructure consulting that can help review default configurations and reduce exposure before an attacker finds them. The immediate action for Bifrost operators is to update to a patched version and tighten the management interface, especially on containers that publish their ports to the internet.