Two vulnerabilities have been discovered in the open AI gateway Bifrost, which routes requests to more than 20 large language model providers, allowing an unauthenticated attacker to execute arbitrary commands on the server. The most dangerous of them — CVE-2026-90898 — can be exploited with a single HTTP request to the management API under the default configuration. According to JFrog Security Research, the CVSS score is 9.8. The fix is available in version transports/v2.1.0. Operators using Bifrost with management API authentication disabled (the default setting) should update immediately or apply workarounds.
Technical details of the vulnerabilities
CVE-2026-90898: command execution via MCP client registration
Researcher Yuval Moravchik from JFrog discovered that when authentication of the management API is disabled (the governance.auth_config.is_enabled parameter is set to false by default), an attacker can send a single POST request to the /api/mcp/client endpoint and register an MCP client of type stdio. Bifrost immediately launches the command specified in the request on behalf of the gateway process — even before the MCP handshake is completed. In the official Docker image, the process runs as the appuser user.
All versions of Bifrost HTTP transport before 2.1.0 are affected, including version 2.0.0 and the 1.6.x line up to and including 1.6.11. Since the gateway stores API keys for connected providers, executing commands in the context of the gateway process potentially gives the attacker access to these credentials.
CVE-2026-86242: loading a malicious plugin over HTTP
The second vulnerability, CVE-2026-86242, was disclosed by JFrog on September 6. According to the researchers, the CVSS score is 8.1. An unauthenticated attacker can register a custom plugin by specifying an HTTP address as the path. Bifrost downloads the file, writes it as a temporary shared object, and loads it via the plugin.Open function in Go.
The impact depends on the build type: on dynamically linked builds (required for custom Go plugins), the loaded code is executed in the context of the gateway process. On statically linked builds, including the official Docker image, plugin.Open fails with an error, and the vulnerability is reduced to server-side request forgery (SSRF). The fix is available starting from transports/v2.0.0.
Patch priority differences
The two vulnerabilities require different upgrade decisions. CVE-2026-90898 is fixed only in version transports/v2.1.0 — the intermediate 2.0.0 release remains vulnerable. CVE-2026-86242 was already fixed in transports/v2.0.0. For typical deployments based on the official Docker image (static linking), CVE-2026-90898 poses the greatest threat: the path to arbitrary command execution works on this image without additional conditions. The remote code execution path via CVE-2026-86242 on the same image is blocked and reduced to SSRF only. Thus, upgrading to transports/v2.1.0 closes both vulnerabilities and should be the priority.
Network exposure: binary and Docker
The exposure of the management API depends on the deployment method. The standard Bifrost binary binds the management API to localhost, limiting access to the local machine. The official Docker image binds it to 0.0.0.0 — if the port is published, the API becomes accessible from outside the container. This difference is critical when assessing actual risk: containerized deployments with an exposed management port are subject to remote exploitation without any additional conditions.
Context: third vulnerability in a month
Both vulnerabilities share a single root cause — the Bifrost management API is shipped with authentication disabled by default. These are already the second and third security issues disclosed in the project in less than a month: earlier, in late August, an unrelated SSRF vulnerability CVE-2026-55245 was fixed (details about it are confirmed only by the original news report; the primary advisory has not been obtained).
At the time of publication, none of the Bifrost vulnerabilities are listed in the CISA KEV catalog, and no independent evidence of active exploitation has been found. However, public proofs of concept exist, and a similar command injection vulnerability in another AI gateway, LiteLLM, according to the original material, was added to the CISA KEV catalog in June 2026 after confirmed exploitation.
Recommendations
- Update Bifrost HTTP transport to version transports/v2.1.0 — this closes both vulnerabilities. Version 2.0.0 fixes only CVE-2026-86242.
- If an immediate update is not possible, enable authentication for the management API: set
governance.auth_config.is_enabledtotrueand configure strong credentials. - Restrict network access to the management API: do not expose the management port to untrusted networks, especially in Docker deployments.
- JFrog recommends treating as compromised any instance that has run with authentication disabled and a management API accessible from outside. In such cases, it is necessary to rotate virtual keys and provider API keys.
- The 1.6.x line up to and including 1.6.11 does not contain any of the fixes — migration to 2.1.0 is mandatory.
Both Bifrost vulnerabilities stem from the architectural decision to ship the management API without authentication enabled by default. For operators using Bifrost in containerized environments with an exposed management port, the only reliable course of action is to upgrade to transports/v2.1.0 while simultaneously rotating all provider keys if the instance might have been accessible from outside.
