Critical Bifrost AI Gateway Flaw Allows Unauthenticated Command Execution

A critical vulnerability has been discovered in Bifrost, an open-source AI gateway designed to route requests to over 20 different LLM providers. This flaw, tracked as CVE-2026-90898 and carrying a severe CVSS score of 9.8, allows unauthenticated attackers to execute arbitrary commands on the gateway server with a single HTTP request. The vulnerability affects all versions of the Bifrost HTTP transport prior to version 2.1.0, particularly when management authentication is disabled, which is the default configuration.

The discovery was made by Yuval Moravchick of JFrog Security Research. According to the findings, an attacker can exploit this vulnerability by registering a stdio-type MCP client through an unauthenticated POST request to the management API endpoint /api/mcp/client. Bifrost then immediately starts the specified command as the gateway process user, even before any formal MCP handshake occurs. On the official Docker image, this user is typically appuser.

This command execution capability poses a significant risk because the Bifrost gateway stores API keys for every connected LLM provider. By gaining control of the gateway process, an attacker can access and exfiltrate these sensitive credentials, potentially leading to further compromise of AI services and data. While the default configuration of the stock Bifrost binary binds the management API to localhost, limiting exposure to the local machine, the official Docker image binds to 0.0.0.0. This makes the management API reachable from external networks if the port is published, greatly increasing the attack surface.

To address this critical vulnerability, operators are strongly advised to upgrade to Bifrost transports version 2.1.0. This updated version implements a fix that returns a 403 Forbidden error when an unauthenticated caller attempts to register a stdio MCP client. For organizations unable to upgrade immediately, JFrog recommends enabling management authentication by setting governance.auth_config.is_enabled to true, using strong credentials, and ensuring the management listener is not exposed to untrusted networks.

JFrog further advises that any Bifrost instance that has run with authentication disabled and the management API exposed should be treated as potentially compromised. In such cases, it is crucial to rotate both virtual keys and provider API keys immediately. Operators using transports version 2.0.0 are still vulnerable to this MCP flaw, as this release only addressed an earlier plugin vulnerability and did not block the unauthenticated registration. Versions in the 1.6.x line, including 1.6.11, are also affected by this vulnerability.

Adding to the security concerns, a second, related flaw (CVE-2026-86242, CVSS 8.1) was disclosed by Or Peles of JFrog Security Research on September 6. This vulnerability allows an unauthenticated attacker to register a custom plugin where the path is an HTTP URL. Bifrost will download this file, save it as a temporary shared object, and attempt to load it. On dynamically linked builds, this results in code execution as the gateway process user. However, on statically linked builds, such as the official Docker image, the plugin.Open function fails, leading only to Server-Side Request Forgery (SSRF).

Both of these critical vulnerabilities share a common root cause: the Bifrost management API is shipped with authentication disabled by default. These are the second and third security issues disclosed for the Bifrost project in less than a month, following an unrelated SSRF flaw (CVE-2026-55245) that was patched in late August. The MCP flaw, in particular, echoes a pattern seen in previous attacks, including a design flaw in MCP's STDIO transport affecting Anthropic's SDKs and a similar command-injection flaw in LiteLLM, which was actively exploited and added to CISA's Known Exploited Vulnerabilities (KEV) catalog.

As of the publication of this report, neither of the newly disclosed Bifrost CVEs (CVE-2026-90898 or CVE-2026-86242) have been added to the CISA KEV catalog, highlighting a potential gap in immediate threat prioritization for some organizations.