Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials

1. Executive summary

CVE-2026-90898 (CVSS 9.8, CRITICAL, CWE-284 and CWE-306) is an unauthenticated command-execution flaw in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers. An attacker sends a single unauthenticated POST to the management API endpoint /api/mcp/client to register a stdio-type MCP client; Bifrost starts the specified command immediately, before any MCP handshake, as the gateway process user. All versions of the Bifrost HTTP transport before 2.1.0 are affected when management authentication is disabled, which is the default configuration. The flaw is not in CISA KEV and EPSS is 0% as of publication, but the blast radius for financial services is high: the gateway stores API keys for every connected LLM provider, so code execution on the gateway process exposes those credentials. A fix is available in transports/v2.1.0.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 19: reporting of major ICT-related incidents to competent authorities	An unauthenticated single-request compromise path that yields command execution and access to all stored provider API keys; any instance with the management API exposed and auth disabled must be treated as compromised per the researcher's guidance	If compromise is confirmed on an in-scope instance, the incident classification and major-incident reporting process is engaged; document the exposure window and key-rotation evidence
DORA Art. 28: ICT third-party risk — general principles	Bifrost is an open-source component sitting in the LLM request path and holding credentials for every connected provider, and the project has now disclosed three security issues in under a month	Fold Bifrost and equivalent AI gateways into ICT third-party/supply-chain risk assessment; require authentication-enabled configurations and version pinning in contracts and onboarding checks

No NIS2 or UK NIS article is engaged by a fact distinctive to this item beyond the generic incident/patching case.

3. Technical analysis & attack chain

Confirmed attack chain, from the JFrog Security Research disclosure:

The attacker identifies a Bifrost instance whose management API is reachable. The stock binary binds the management API to localhost by default; the official Docker image binds to 0.0.0.0, so the API is reachable from outside the container if the port is published.
Management authentication is disabled, which is the default configuration (governance.auth_config.is_enabled false).
The attacker sends a single unauthenticated POST to the management API endpoint /api/mcp/client registering a stdio-type MCP client with an attacker-chosen command.
Bifrost starts the specified command immediately, before any MCP handshake, as the gateway process user. On the official Docker image that user is appuser.
The command runs with the gateway process's access, which includes the API keys stored for every connected LLM provider. The attacker can read and exfiltrate those credentials.

The vulnerability mechanism is missing authentication on a critical management function (CWE-306) and improper access control (CWE-284): the MCP client registration endpoint performs no authentication check before spawning a process. The fix in transports/v2.1.0 returns 403 when an unauthenticated caller tries to register a stdio MCP client.

A second, related flaw in the same management API was disclosed on 6 September by Or Peles of the same JFrog team. CVE-2026-86242 (CVSS 8.1) lets an unauthenticated attacker register a custom plugin whose path is an HTTP URL; Bifrost downloads the file, writes it as a temporary shared object, and loads it through Go's plugin.Open function. On dynamically linked builds, which Bifrost requires for custom Go plugins, the plugin loads and its code runs as the gateway process user. On statically linked builds, including the official Docker image, plugin.Open fails and the result is server-side request forgery only. The fix is in transports/v2.0.0. Both flaws share the same root cause: the management API ships with authentication disabled by default.

Context, single-sourced to the vendor report: this is the second and third security issue disclosed in the Bifrost project in under a month, after an unrelated SSRF flaw (CVE-2026-55245) fixed in late August. The report also draws a pattern comparison: a similar command-injection flaw in LiteLLM, another AI gateway, was actively exploited and added to CISA's KEV catalog in June, and an MCP STDIO transport design flaw affecting Anthropic's official SDKs was disclosed in April 2026. Neither Bifrost CVE appears in KEV as of publication, and EPSS for CVE-2026-90898 is 0%. No threat actor attribution is claimed in the source material and none should be assumed; no in-the-wild exploitation of either Bifrost flaw has been reported.

4. Mitigation & containment

P1, within 24 hours:

Inventory for Bifrost deployments (search container registries and image layers for the official Bifrost Docker image and for the management port). For each instance, record the transport version and whether the management API is bound to 0.0.0.0 or published beyond localhost.
Upgrade to transports/v2.1.0 or later. This is the only version that blocks unauthenticated stdio MCP client registration. Do not treat v2.0.0 as patched for CVE-2026-90898; it is not.
If upgrade is not immediately possible, set governance.auth_config.is_enabled to true, use strong credentials, and keep the management listener off untrusted networks. Restrict network access to the management API port at the firewall/security-group layer to trusted administration hosts only.
Treat any instance that ran with authentication disabled and the management API exposed as compromised. Rotate virtual keys and provider API keys for every connected LLM provider on those instances.

P2, within 72 hours:

Review gateway logs for unauthenticated POSTs to /api/mcp/client and for plugin registrations pointing at HTTP URLs, across the full exposure window. Where logs are insufficient to rule out access, apply the compromise assumption from P1 and rotate keys.
Verify the CVE-2026-86242 fix status: any instance below transports/v2.0.0 is exposed to the plugin-download flaw. Dynamically linked builds get code execution from it; statically linked builds including the official Docker image get SSRF only. The v2.1.0 upgrade covers both flaws.
Confirm the 1.6.x line is out of support for these fixes: 1.6.11 and earlier contain neither patch, so instances on that line must move to 2.1.0+.

P3, within 7 days:

Add Bifrost and equivalent AI gateways to the standard build hardening baseline: management authentication enabled at deploy time, management API bound to localhost unless a documented need exists, and version pinning at 2.1.0 or later.
Add a configuration check to deployment pipelines that fails builds where governance.auth_config.is_enabled is false or the management listener binds 0.0.0.0 without an approved exception.

5. Indicators of compromise

No atomic indicators of compromise are available in the source material. The disclosure describes no attacker tooling, payloads, domains, IPs or hashes.

Behavioural indicators:

Behaviour	Where to observe	Confidence
Unauthenticated POST to `/api/mcp/client` registering a stdio-type MCP client	Bifrost management API access logs, reverse-proxy or load-balancer logs in front of the gateway	High, from the disclosure; the endpoint and method are confirmed
Registration of a custom plugin whose path is an HTTP URL (CVE-2026-86242)	Bifrost management API logs, outbound HTTP from the gateway process to the plugin URL	High, from the disclosure
Outbound traffic from the gateway process to attacker-controlled hosts following command execution	EDR process-network telemetry for the gateway process (`appuser` in the official Docker image)	Medium, inferred from the confirmed execution mechanism
Access to or exfiltration of stored provider API keys	Provider-side API key usage logs, anomalous LLM API consumption	Medium, inferred from the confirmed credential store

6. Detection

The source material provides endpoint paths and configuration keys but no file artefacts, strings or hashes from any malicious payload, so no YARA rule can be authored from threat artefacts. The observable material is log-based, which supports a Sigma rule.

title: Bifrost AI Gateway Unauthenticated MCP Client Registration (CVE-2026-90898)
id: 7c1f2a44-8b3e-4d19-9f6a-2e5c8d17a0b3
status: experimental
description: Detects POST requests to the Bifrost management API MCP client registration endpoint, unauthenticated per CVE-2026-90898. Tune for your gateway deployment and authentication state.
references:

  - https://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.html
author: Adverse Trace
date: 2026-09-22
logsource:
  category: webserver
detection:
  selection:
    http.method: 'POST'
    cs-uri-stem|endswith: '/api/mcp/client'
  condition: selection
falsepositives:

  - Legitimate MCP client registrations by gateway administrators
  - Authenticated registrations on patched instances (transports/v2.1.0+); correlate with response status 403 to reduce noise
level: high

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

CVE	CVSS	Exploited	EPSS	Summary
CVE-2026-90898	9.8 Critical	—	0%	Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in…

7. Sources

The Hacker News, "Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials", https://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.html, 2026-09-22
JFrog Security Research (credited in the primary source for the discovery and technical detail by Yuval Moravchick and Or Peles), 2026-09-22

8. Adverse Trace position

We assess CVE-2026-90898 as a critical-severity exposure for any client running Bifrost with the management API reachable beyond localhost, on the verified CVSS 9.8 rating, despite the current 0% EPSS and absence from CISA KEV: the exploit is a single unauthenticated HTTP request, the vulnerable configuration is the default, and successful execution exposes every stored provider API key. The same class of flaw in LiteLLM moved to active exploitation and KEV listing within weeks of disclosure, and we treat that as the realistic trajectory here, though no exploitation of the Bifrost flaws has been reported and that comparison is single-sourced to the vendor report. All technical detail in this advisory rests on a single vendor disclosure (JFrog) relayed through one press report; verify the endpoint behaviour against your own instances before enforcing blocking rules. We will monitor for KEV listing, EPSS movement, and any proof-of-concept publication, and will reissue if exploitation is confirmed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.