Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Bifrost lets anyone run code on your gateway

CVE-2026-90898 · published 27 days ago
Summary

The Bifrost management interface can start any command on the server when a client is added, and in version 2.0.0 it does not require a login. An unauthenticated request can therefore execute programs with the same rights as the Bifrost service account. Enable the built‑in authentication setting or upgrade to version 2.1.0, which blocks this behavior.

What to do
  • Update maximhq bifrost to version 2.1.0 or later.
Affected software
VendorProductAffected versions
maximhq bifrost < 2.1.0
Original advisory text
Bifrost unauthenticated remote code execution via MCP stdio client registration
Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.



The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).



 transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
CWE-284Improper Access Control
Timeline
Published14 Sep 2026
Updated11 Oct 2026
First seen14 Sep 2026
Sources
CVE-2026-90898 · NVD
CVE-2026-90898 · MITRE
CVE-2026-90898 · OSV
Track software like this
Free during beta