CVE-2026-90898

Bifrost, an open-source MCP gateway, exposes a management API for registering MCP clients, and a stdio client registration is simply a command plus arguments that the gateway executes immediately upon addition, with no MCP handshake required. Because the default configuration ships with governance.auth_config.is_enabled=false, every caller of the management API is treated as a local admin, so a single unauthenticated POST to /api/mcp/client lets an attacker run an arbitrary program as the Bifrost process user (appuser in the official container image), giving full system compromise with CVSS 9.8. Any deployment running the vulnerable transports plugin with the management API network-reachable and default auth disabled is affected. The transports plugin v2.1.0 mitigates this by returning 403 for unauthenticated stdio registrations, but transports v2.0.0 still allows it. No public proof of concept and no in-the-wild exploitation are known at this time.

What to do: Upgrade the transports plugin to v2.1.0 or later, which rejects unauthenticated stdio client registrations with a 403. Independently, enable governance authentication by setting governance.auth_config.is_enabled=true and restrict network access to the management API (/api/mcp/client and related endpoints) to trusted networks only. Audit gateway logs for unexpected MCP client registrations or spawned child processes running as the appuser account.