A serious security vulnerability in Bifrost, an open-source AI gateway used to manage and route requests to more than providers large language model (LLM), could allow unauthenticated attackers to execute arbitrary commands on the server where the gateway runs.
The issue is listed as CVE-2026-90898 and has a CVSS score of 9.8, which makes it a critical vulnerability. The vulnerability affects versions of the Bifrost HTTP transport prior to transports/v2.1.0, when authentication for the management API remains disabled.
A single HTTP request is enough for the attack
The finding was discovered by Yuval Moravchick of JFrog Security Research. As it turned out, an attacker can send a specially crafted, unauthenticated POST request to the /api/mcp/client and register an MCP client of type stdio.
The particularly dangerous point is that Bifrost attempts to execute the command declared during registration, before the normal Model Context Protocol (MCP) handshake process has taken place. In other words, the input check is performed at a stage where the attacker may have already caused code execution.
The command is executed with the privileges of the account used by the gateway process. This turns a seemingly simple administrative operation into a potential point of complete compromise of the given server.
AI providers' API keys also in the spotlight
The risk is made even greater because Bifrost doesn’t just act as an intermediary for AI requests. The platform stores API keys for the different LLM providers that are connected to it.
In the official Docker image, the process is run by the user appuser. If an attacker manages to execute commands within this process, they can attempt to identify stored credentials and other sensitive information.
Such a breach could have consequences beyond the server itself. Stolen API keys could, depending on their privileges, be used to make unauthorized requests to AI services, creating financial costs or allowing access to infrastructure connected to the gateway.
Docker configuration increases exposure
There is one more important parameter regarding the way Bifrost is installed. The standard binary limits the management API to localhost, significantly limiting access from external systems.
The official Docker image, on the other hand, binds to the address 0.0.0.0. This means that the API can be accessed outside the container when the corresponding port is published.
Therefore, the risk depends not only on the existence of the vulnerability, but also on the deployment. A system that exposes the management API to an untrusted network presents a significantly larger attack surface.
How can administrators protect themselves?
The main recommendation is to immediately upgrade to transports/v2.1.0, where this specific vulnerability has been fixed. The new version rejects an attempt by an unauthenticated user to register an MCP stdio client and returns an HTTP 403 code.
In environments where the upgrade cannot be performed immediately, administrators should enable authentication via the governance.auth_config.is_enabled, use strong credentials , and restrict access to the management listener.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
JFrog also recommends that installations where the management API was exposed while authentication remained disabled be treated as potentially compromised. In these cases, logs and rotation of virtual keys and API keys of connected providers should be reviewed.
Second vulnerability concerns custom plugins
CVE-2026-90898 is not the only recent Bifrost issue. CVE-2026-86242, with a CVSS score of 8.1, also allows an unauthenticated attacker to register a custom plugin via an HTTP URL.
Bifrost downloads the file, caches it, and attempts to load it via plugin.Open . In dynamically linked builds, the plugin can be loaded and executed with the privileges of the gateway process.
See also: RD Gateway UAF vulnerability allows RCE
In statically linked builds, including the official Docker image, this operation fails and the impact is limited to SSRF. The fix for this issue is included in transports/v2.0.0.
Recurring issue with the management API
A common denominator of both vulnerabilities is the default disabling of authentication in the management API. This creates a particularly important lesson for AI infrastructures: management endpoints should not be treated as secure simply because they are behind an internal network or container.
Bifrost has already been hit by CVE-2026-55245, a separate SSRF vulnerability that was patched in late August. This marks the second and third security issues to be disclosed to the project in less than a month.
AI gateways become a critical target
The case takes on even greater significance when viewed in the context of the increasing use of AI gateways and MCPs. In April 2026, issues were identified in the MCP's STDIO transport, while a similar command injection vulnerability in LiteLLM was actively exploited and added to the CISA KEV list in June.
The two Bifrost CVEs were not listed in the KEV at the time of publication. However, their absence from the list does not mean they can be ignored. For organizations using AI gateways, securing management APIs, authenticating, limiting network exposure, and regularly refreshing API credentials are now key defenses.
See also: CVE-2026-76461: Critical zero-day in Cisco Secure Email Gateway
The incident ultimately shows that AI infrastructures are not protected by model-level security alone. When a gateway aggregates multiple LLMs, plugins, and API keys, the gateway itself becomes a critical control point — and therefore a particularly attractive target for attackers.
Administrators should upgrade to transports/v2.1.0, which returns 403 when an unauthenticated caller attempts to register a stdio MCP client. Those who cannot upgrade immediately should set governance.auth_config.is_enabled to true, use strong credentials , and keep the governance listener off untrusted networks.
