A critical vulnerability in Bifrost is putting AI infrastructure at risk. The open-source gateway, which routes requests to more than 20 LLM providers, allows unauthenticated attackers to run arbitrary commands on servers. Researchers disclosed the flaw on September 22, 2026, with a patch already available.
The vulnerability, tracked as CVE-2026-90898, carries a CVSS score of 9.8. It affects all Bifrost HTTP transport versions before 2.1.0 when management authentication is disabled. By default, authentication comes disabled out of the box. This means most deployments ship vulnerable unless operators explicitly enable the security setting.
Yuval Moravchick from JFrog Security Research discovered the flaw. An attacker can register a stdio-type MCP client through a single unauthenticated POST request to the management API endpoint /api/mcp/client. Bifrost starts the specified command immediately, before any MCP handshake verification. The command executes as the gateway process user, which on Docker is appuser.
This matters because Bifrost stores API keys for every connected LLM provider. Executing commands on the gateway grants attackers immediate access to these credentials. They can steal keys for OpenAI, Anthropic, Google, and other services integrated with Bifrost. Downstream attacks on compromised customer accounts become inevitable.
Exposure depends on deployment architecture. The stock Bifrost binary binds the management API to localhost by default, limiting attacks to local machines. However, the official Docker image binds to 0.0.0.0, making the management API reachable from outside the container if the port is published to untrusted networks. Container deployments face significantly higher risk.
Maxim, the company behind Bifrost, disputes the severity rating. Their CTO Akshay Deo told The Hacker News that practical risk is lower than CVSS 9.8 suggests. The company argues exploitation requires two conditions: the management interface must be reachable from an untrusted network AND operators must have authentication disabled. Bifrost’s documented default deployment places the gateway inside private networks only. JFrog assigned the CVE anyway, and Maxim is working to revise the severity assessment.
A second related flaw, CVE-2026-86242, carries a CVSS score of 8.1. It allows unauthenticated registration of custom plugins loaded as HTTP URLs. Both flaws share the same root cause: authentication disabled by default. This follows a pattern in the AI infrastructure space. MCP STDIO transport vulnerabilities affected Anthropic’s official SDKs in April 2026. LiteLLM, another AI gateway, suffered a similar command-injection flaw that was actively exploited in June 2026 and added to CISA’s Known Exploited Vulnerabilities catalog.
Operators using Bifrost should upgrade to transports/v2.1.0 immediately. Those unable to upgrade should enable authentication, use strong credentials, and isolate the management listener from untrusted networks. Any instance running with authentication disabled and exposed management API should be treated as compromised.
