Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials
Unauthenticated Bifrost flaw CVE-2026-90898 lets attackers run commands and steal provider API keys.
JFrog disclosed CVE-2026-90898 (CVSS 9.8), an unauthenticated command-execution flaw in the Bifrost AI gateway affecting HTTP transports before 2.1.0 when management authentication is disabled by default. A single POST to /api/mcp/client can register a stdio MCP client that Bifrost executes as the gateway user, exposing stored provider API keys. Related flaw CVE-2026-86242 (CVSS 8.1), fixed in 2.0.0, can load a remote plugin or cause SSRF, after earlier SSRF CVE-2026-55245. Neither Bifrost CVE is in CISA's KEV catalog.
- CVE-2026-90898 is CVSS 9.8 and needs no credentials
- Default Docker image binds the management API to 0.0.0.0
- Upgrade to transports/v2.1.0 or enable management authentication
- CVE-2026-86242 allows remote plugin loading or SSRF
- Neither Bifrost CVE is listed in CISA KEV
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-55245 | SSRF in Bifrost AI gateway lets attackers reach internal and cloud metadata services | 8.7 | <1% | ||
| CVE-2026-86242 | Unauthenticated RCE/SSRF in Bifrost HTTP transport plugin install API | 8.1 | <1% | ||
| CVE-2026-90898 | Unauthenticated Remote Code Execution via MCP Client Registration in Bifrost | 9.8 | 2% | PoC |
From the original article
2 min read at thehackernews.com
A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request. The flaw, tracked as CVE-2026-90898 (CVSS score: 9. 8), affects all versions of the Bifrost HTTP transport before 2.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.