A critical security vulnerability in Bifrost, an open-source AI gateway designed to connect applications with more than 20 large language model providers, could allow unauthenticated attackers to execute arbitrary commands on affected servers.
Tracked as CVE-2026-90898 and rated 9.8 (Critical) on the CVSS scale, the flaw affects Bifrost’s HTTP transport versions before 2.1.0 when management API authentication is disabled. According to researchers, authentication is disabled by default in the affected configuration.
A security update addressing the issue is available in transports/v2.1.0.
Vulnerability Enables Command Execution
The vulnerability was discovered by Yuval Moravchick of JFrog Security Research.
According to the researcher, an attacker can exploit the issue by registering a specially crafted stdio-type MCP client through an unauthenticated request to Bifrost’s management API.
The gateway launches the specified command immediately, before completing an MCP handshake. The command runs with the same privileges as the Bifrost gateway process.
This creates a significant security risk because Bifrost may hold credentials and API keys used to communicate with multiple AI providers.
Provider API Keys Could Be Exposed
Bifrost gateways can store credentials required to access connected LLM and AI services. If an attacker gains command execution on the gateway server, those credentials could potentially be accessed.
On Bifrost’s official Docker image, the gateway process operates under the appuser account. While this may limit operating-system privileges, command execution could still expose sensitive application data and provider credentials available to the process.
A successful compromise could therefore extend beyond the Bifrost server itself and potentially affect connected AI services.
Docker Configuration Can Increase Exposure
The standard Bifrost binary binds its management API to localhost by default, which limits access to applications running on the same machine.
The official Docker image, however, binds the management interface to 0.0.0.0. If the relevant container port is published, the management API may become accessible from outside the container.
This configuration can significantly increase the attack surface, particularly when the management endpoint is exposed to an untrusted network.
Bifrost 2.1.0 Blocks the Attack
Bifrost maintainers have addressed the vulnerability in transports/v2.1.0.
The patched release prevents unauthenticated users from registering stdio MCP clients and returns a 403 Forbidden response when such an attempt is made without proper authorization.
Security researchers recommend upgrading affected installations as soon as possible.
Organizations that cannot immediately upgrade should enable Bifrost management authentication by setting governance.auth_config.is_enabled to true, use strong credentials and ensure the management interface is not exposed to untrusted networks.
Earlier Versions Remain Vulnerable
Researchers warned that installing transports/v2.0.0 does not resolve the newly disclosed MCP command-execution vulnerability.
Version 2.0.0 addressed a separate plugin-related security issue, but it did not prevent unauthenticated registration of stdio MCP clients.
The 1.6.x branch through 1.6.11 also does not contain the relevant fixes.
JFrog recommends treating exposed Bifrost deployments that operated with authentication disabled as potentially compromised and rotating affected provider API keys and virtual credentials.
Second Bifrost Vulnerability Also Disclosed
The latest issue follows another significant vulnerability disclosed earlier in September.
Researchers including Or Peles of JFrog Security Research identified CVE-2026-86242, an authentication-bypass-related plugin vulnerability carrying a CVSS score of 8.1.
The flaw allowed an unauthenticated attacker to register a custom plugin using an HTTP URL as its path. Bifrost could then download the specified file, store it temporarily as a shared object and attempt to load it through Go’s plugin.Open functionality.
On dynamically linked Bifrost builds, the plugin could execute code with the privileges of the gateway process.
The situation differs on statically linked builds, including the official Docker image. In those configurations, plugin.Open fails, limiting the issue to server-side request forgery (SSRF) rather than direct code execution.
The plugin vulnerability was fixed in transports/v2.0.0.
Multiple Security Issues Hit Bifrost in Recent Weeks
The two vulnerabilities share a common underlying issue: the Bifrost management API has authentication disabled by default.
They also represent the second and third security problems publicly disclosed in the project in less than a month. An unrelated SSRF vulnerability, CVE-2026-55245, was addressed in late August.
The newly reported MCP flaw is particularly notable because similar weaknesses involving AI infrastructure and MCP implementations have already raised security concerns across the industry.
Researchers previously identified a design weakness involving MCP’s STDIO transport, while a separate command-injection vulnerability affecting LiteLLM, another AI gateway, was exploited in real-world attacks and subsequently added to CISA’s Known Exploited Vulnerabilities catalog.
