An open-source AI gateway called Bifrost has a dangerous flaw that can allow malicious actors to execute commands on the server without any authentication. The issue, tracked as CVE-2026-90898 with a severity score of 9.8 out of 10, impacts all Bifrost HTTP transport versions prior to 2.1.0 when the management API is left unauthenticated—its default setup. The vulnerability has now been addressed in the transports/v2.1.0 patch.
The bypass exploits the management API endpoint /api/mcp/client. It allows an unauthenticated user to register a “stdio-type MCP client” via a POST request. Before any authentication steps or secure handshake, Bifrost immediately runs the command supplied by the client—under the privileges of the gateway’s process user. In the default Docker setup, that user is “appuser.” This is especially perilous because that process holds API keys for all connected providers, which are exposed once an attacker gains command-run access.
What Increased the Risk
Several operational details widen this threat landscape. In the stock binary, Bifrost’s management API binds to localhost—limiting exposure to local systems. However, the official Docker image binds the API listener to 0.0.0.0, meaning that if the port is published, any external actor can reach it. Also, many setups remain in the vulnerable state because authentication is disabled by default.
For environments unable to immediately apply version 2.1.0, mitigations include enabling governance authentication by setting governance.auth_config.is_enabled to true, choosing strong credentials, and not exposing the management listener to untrusted networks. Any instance that ran with the API exposed and without authentication should be treated as compromised; all API keys and provider credentials must be rotated.
Also Affected: Plugin Download Vulnerability
A related flaw, CVE-2026-86242 (rated 8.1), lets unauthenticated users register custom plugins via URLs. Bifrost fetches the plugin file, saves it as a shared object, and loads it using Go’s plugin.Open. On dynamically linked builds, the plugin runs with gateway privileges; on statically linked builds, code execution fails but server-side request forgery remains possible. This flaw is fixed in transports/v2.0.0.
Both issues share a root cause: the management API being unauthenticated by default. They follow on the heels of another serious issue (CVE-2026-55245), a server-side request forgery vulnerability fixed just weeks earlier. Multiple AI gateway projects have seen similar command execution risks: MCP’s STDIO transport flaw was highlighted in April 2026, and LiteLLM was found to be actively exploited for code execution in mid-2026.
None of these new CVEs currently appear in the Known Exploited Vulnerabilities (KEV) catalog, so systems using Bifrost should assume risk until fully patched.
Why It Matters: Bifrost is used to route requests among over 20 different large language models (LLMs). Its security underpins model access across organizations and platforms. A failure here doesn’t just jeopardize one service—it compromises every provider behind the gateway.
Your Takeaway: If you’re running Bifrost, especially via Docker or with the management API exposed, upgrade to transports/v2.1.0 immediately. For those who can’t, lock down the API, require authentication, close off external access, and rotate all keys. The exposure is real, the attack is simple, and it can grant full access to everything inside Bifrost.
