Critical Bifrost AI Gateway Flaw Let Attackers Run Commands Without Credentials

Overview

A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request, according to The Hacker News. The flaw, tracked as CVE-2026-90898 with a CVSS score of 9.8, affects all versions of the Bifrost HTTP transport before 2.1.0 when management authentication is disabled — the default configuration — according to The Hacker News.

What We Know

• Bifrost is an open-source AI gateway maintained by the GitHub organization maximhq that unifies access to multiple large-language-model providers behind a single API, according to the project’s GitHub Security Advisory.
• Yuval Moravchick of JFrog Security Research discovered the flaw. He found that an attacker can register a stdio-type MCP (Model Context Protocol) client through a single unauthenticated POST request to the management API endpoint /api/mcp/client, according to The Hacker News. Bifrost starts the specified command immediately, before any MCP handshake occurs, running as the gateway process user, according to The Hacker News.
• The GitHub Security Advisory for CVE-2026-90898 describes the same mechanism: “Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required,” according to the advisory.
• The advisory lists transports/v2.0.0 and earlier as vulnerable and transports/v2.1.0 as the patched version, with a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and classifies the weakness as CWE-284, Improper Access Control, according to the GitHub Security Advisory. The advisory was published September 14, 2026.
• Because Bifrost is a gateway that holds credentials for every connected LLM provider it routes traffic to, the improper access control exposes those stored provider API keys to an attacker who successfully registers a malicious MCP client, according to The Hacker News.
• Exposure depends on deployment: the stock Bifrost binary binds its management API to localhost by default, limiting exposure, but the official Docker image binds the management API to 0.0.0.0, making it externally reachable if that port is published, according to The Hacker News.
• Organizations that cannot upgrade immediately can mitigate by enabling authentication through the governance.auth_config.is_enabled setting and restricting access to the management listener to trusted networks, according to The Hacker News. The same default-disabled setting, governance.auth_config.is_enabled=false, is cited in the advisory’s own description of the vulnerable configuration, according to the GitHub Security Advisory.
• A second, related flaw, CVE-2026-86242 with a CVSS score of 8.1, allows registration of a custom plugin whose path is an HTTP URL through an unauthenticated POST request to /api/plugins, also when management authentication is disabled, according to The Hacker News and the GitHub Security Advisory for that CVE.
• That second advisory states the plugin-loading mechanism results in unauthenticated remote code execution on dynamically linked builds, while static builds instead fail at the plugin-loading stage and only produce server-side request forgery, according to the GitHub Security Advisory. It classifies the weakness as CWE-94, Improper Control of Generation of Code, and states “the 1.6.x line through 1.6.11 lacks the fix,” and it was published September 6, 2026, according to the same advisory.

What We Don’t Know

• Neither advisory nor The Hacker News’ report specifies whether either flaw has been exploited in the wild; both are described as vulnerabilities discovered and disclosed through JFrog’s security research process rather than as active incidents.
• The exact date the transports/v2.1.0 fix was released is not established here; the GitHub Security Advisory for CVE-2026-90898 lists a publication date of September 14, 2026, and The Hacker News covered both flaws on September 22, 2026, but no source in hand ties the release of the patched version to either of those dates specifically.

Analysis

The Bifrost disclosures illustrate a pattern specific to the emerging AI-gateway layer of software infrastructure: these gateways are built to hold and broker credentials for many upstream LLM providers at once, so an access-control gap in the gateway’s own management interface has outsized blast radius compared with a similar flaw in a single-purpose application. Both CVE-2026-90898 and CVE-2026-86242 trace back to the same root condition — Bifrost shipping with its management API authentication disabled by default — which the GitHub Security Advisory for CVE-2026-90898 says grants “local admin privileges” to any caller when that default is left unchanged, according to the advisory.