A critical vulnerability, **CVE-2026-90898** (CVSS score: 9.8), has been identified in **Bifrost**, an open-source AI gateway designed to route requests to over 20 different LLM providers. This flaw enables an unauthenticated attacker to execute arbitrary commands on the gateway server with a single HTTP request. ### Unauthenticated Remote Code Execution The vulnerability affects all versions of the **Bifrost** HTTP transport prior to 2.1.0, particularly when management authentication is disabled – which is the default configuration. **Yuval Moravchick** of **JFrog Security Research** discovered the flaw, noting that an attacker can register a stdio-type **MCP** client via an unauthenticated POST request to the `/api/mcp/client` management API endpoint. Upon registration, **Bifrost** immediately initiates the specified command, running it as the gateway process user. On the official Docker image, this user is `appuser`. Crucially, the gateway stores API keys for all connected providers, meaning successful exploitation grants attackers access to these sensitive credentials. ### Exposure and Mitigation While the stock **Bifrost** binary binds the management API to localhost by default, limiting local exposure, the official Docker image binds to `0.0.0.0`. This makes the management API externally accessible if the port is published, significantly broadening the attack surface. Operators are strongly advised to upgrade to `transports/v2.1.0`, which implements a 403 Forbidden response for unauthenticated attempts to register a stdio **MCP** client. For those unable to upgrade immediately, enabling `governance.auth_config.is_enabled` with strong credentials and restricting the management listener to trusted networks are crucial interim steps. **JFrog** recommends treating any instance that ran with disabled authentication and an exposed management API as compromised. Virtual keys and provider API keys should be rotated immediately. It's important to note that operators on `transports/v2.0.0` remain vulnerable to this **MCP** flaw, as that release only addressed an earlier plugin vulnerability and does not block unauthenticated registration. The 1.6.x line, up to 1.6.11, contains neither fix. ### Additional Vulnerabilities and Context A second, related flaw, **CVE-2026-86242** (CVSS score: 8.1), was discovered by **Or Peles** of the same research team and disclosed on September 6. This vulnerability allows an unauthenticated attacker to register a custom plugin with an HTTP URL. **Bifrost** then downloads and loads this file as a temporary shared object. On dynamically linked builds (required for custom Go plugins), the plugin executes its code as the gateway process user. On statically linked builds, including the official Docker image, `plugin.Open` fails, resulting in a server-side request forgery (SSRF) instead of RCE. A fix for this issue is available in `transports/v2.0.0`. Both **CVE-2026-90898** and **CVE-2026-86242** stem from the same root cause: **Bifrost**'s management API shipping with authentication disabled by default. These are the second and third security issues identified in the project within a month, following an unrelated SSRF flaw (**CVE-2026-55245**) patched in late August. The **MCP** flaw mirrors a pattern seen in recent real-world attacks. In April 2026, researchers exposed a design flaw in **MCP**'s STDIO transport affecting **Anthropic**'s official SDKs. Similarly, a command-injection flaw in **LiteLLM**, another AI gateway, was actively exploited and added to **CISA**'s Known Exploited Vulnerabilities catalog in June. As of publication, neither **Bifrost** CVE appears in the KEV catalog.