A serious security vulnerability has been identified in Bifrost, an open-source AI gateway that facilitates requests to over 20 large language model (LLM) providers. This flaw enables attackers to execute arbitrary commands on the server without authentication, posing a significant risk to systems using this gateway.
Details of the Bifrost Vulnerability
The vulnerability, cataloged as CVE-2026-90898 with a CVSS score of 9.8, affects all Bifrost HTTP transport versions before 2.1.0 when management authentication is disabled by default. A resolution has been provided in the latest update, transports/v2.1.0. Discovered by Yuval Moravchick from JFrog Security Research, the issue allows an unauthorized user to register a stdio-type MCP client through a single POST request to the management API endpoint.
Upon registration, Bifrost initiates the specified command without any MCP handshake, operating under the gateway process user, known as appuser on the official Docker image. This setup grants the attacker access to API keys for all connected providers, severely compromising security.
Mitigation Steps and Recommendations
Operators are strongly advised to upgrade to transports/v2.1.0, which denies unauthenticated client registration by returning a 403 error. For those unable to upgrade immediately, enabling governance authentication, using robust credentials, and ensuring the management listener is not exposed to untrusted networks are critical steps for protection.
JFrog recommends treating any instance with disabled authentication and exposed management API as compromised. Rotating virtual and provider API keys is essential to secure the system. It’s important to note that the transports/v2.0.0 version does not fix the unauthenticated registration issue, only an earlier plugin vulnerability.
Additional Security Concerns
Another vulnerability discovered by Or Peles from the same research team, identified as CVE-2026-86242 with a CVSS score of 8.1, allows attackers to register a custom plugin using an HTTP URL. This flaw permits the downloading and loading of a potentially malicious shared object file, which runs under the gateway process user in dynamically linked builds.
Both vulnerabilities stem from Bifrost’s management API being shipped with authentication turned off by default. These issues follow a recent pattern of security disclosures, including an SSRF flaw fixed in August 2026, illustrating ongoing challenges in AI gateway security.
The pattern of vulnerabilities, particularly the MCP flaw, highlights potential for real-world attacks, as seen in similar incidents with other AI gateways. As of now, neither Bifrost vulnerability has been added to the Known Exploited Vulnerabilities catalog.
