Bifrost flaw enables unauthenticated commands on AI gateway servers
A critical vulnerability in the open-source Bifrost AI gateway can allow an unauthenticated attacker to execute arbitrary commands on a gateway server through a single HTTP request. Tracked as CVE-2026-90898 and rated CVSS 9.8, the issue affects every Bifrost HTTP transport release before transports/v2.1.0 when management authentication is disabled—the default configuration.
Bifrost routes requests to more than 20 LLM providers. Yuval Moravchick of JFrog Security Research found that an attacker can send an unauthenticated POST request to the management endpoint /api/mcp/client and register a stdio-type MCP client. Bifrost starts the supplied command immediately, before an MCP handshake, under the account running the gateway process.
Management API exposes a route to command execution
On Bifrost’s official Docker image, the gateway process runs as appuser. Command execution in that context is particularly sensitive because the gateway stores API keys for every connected provider. An attacker who gains control of the process could therefore access those credentials.
The default exposure differs between deployment methods. The stock Bifrost binary binds its management API to localhost, restricting access to the local machine. The official Docker image binds the API to 0.0.0.0, however, making it reachable outside the container when an operator publishes the relevant port.
Patch status and mitigation steps
The remediation is available in transports/v2.1.0. In that version, an unauthenticated attempt to register a stdio MCP client receives a 403 response. Transports/v2.0.0 is still vulnerable to CVE-2026-90898: it fixed an earlier plugin issue but did not prevent unauthenticated MCP client registration. The 1.6.x branch through 1.6.11 includes neither fix.
JFrog recommends that organisations unable to upgrade immediately set governance.auth_config.is_enabled to true, use strong credentials and prevent the management listener from being available to untrusted networks. It also advises treating any deployment that had disabled authentication and an exposed management API as compromised, then rotating virtual keys and provider API keys.
A related plugin issue has a different outcome
JFrog researcher Or Peles also disclosed CVE-2026-86242, rated CVSS 8.1, on September 6. That vulnerability allows an unauthenticated caller to register a custom plugin from an HTTP URL. Bifrost downloads the file, writes it as a temporary shared object and attempts to load it with Go’s plugin.Open function.
On dynamically linked builds required for custom Go plugins, the plugin loads and its code runs as the gateway process user. On statically linked builds, including the official Docker image, plugin.Open fails, leaving server-side request forgery as the stated impact. That flaw was fixed in transports/v2.0.0.
Both issues stem from a management API that ships with authentication disabled by default. For businesses operating AI gateways, the immediate implication is to verify management-plane exposure, apply transports/v2.1.0, enforce authentication and rotate credentials wherever an exposed unauthenticated instance may have run.