Ethical Hacking News
A critical flaw has been discovered in the Bifrost AI gateway, allowing unauthenticated attackers to run arbitrary commands on the gateway server. The flaw, CVE-2026-90898, has a CVSS score of 9.8 and affects all versions of the Bifrost HTTP transport before 2.1.0. The discovery highlights the importance of timely patching and robust security measures in the rapidly evolving landscape of AI.
Researchers discovered a critical flaw in the Bifrost AI gateway (CVE-2026-90898) with a CVSS score of 9.8, allowing unauthenticated attackers to run arbitrary commands. The vulnerability affects all versions of Bifrost HTTP transport before 2.1.0 when management authentication is disabled. The flaw allows attackers to register a stdio-type MCP client through a single unauthenticated POST request, granting access to API keys and sensitive data. Organizations relying on Bifrost AI gateway should upgrade to version 2.1.0 or set governance.auth_config.is_enabled to true to mitigate the issue. A second, related flaw (CVE-2026-86242) was discovered, allowing unauthenticated attackers to register custom plugins. The flaws are a result of Bifrost's management API shipping with authentication disabled by default, a pattern that has led to real-world attacks.
A recent discovery of a critical flaw in the Bifrost AI gateway has sent shockwaves throughout the cybersecurity community, highlighting the importance of timely patching and the need for robust security measures in the rapidly evolving landscape of artificial intelligence (AI). The Bifrost AI gateway, an open-source solution that routes requests to more than 20 LLM (Large Language Model) providers, has been found to be vulnerable to an unauthenticated attacker's ability to run arbitrary commands on the gateway server with a single HTTP request.
The flaw, tracked as CVE-2026-90898, has a CVSS (Common Vulnerability Scoring System) score of 9.8, indicating a high level of severity. This vulnerability affects all versions of the Bifrost HTTP transport before 2.1.0 when management authentication is disabled, which is the default configuration. According to Yuval Moravchick, a security researcher at JFrog, who discovered the flaw, an attacker can register a stdio-type MCP client through a single unauthenticated POST to the management API endpoint /api/mcp/client. Once registered, Bifrost starts the specified command immediately, as the gateway process user, without any MCP handshake.
Furthermore, the gateway stores API keys for every connected provider, granting the attacker access to those credentials upon executing commands on the gateway process. The stock Bifrost binary binds the management API to localhost by default, limiting exposure to the local machine. However, the official Docker image binds to 0.0.0.0, making the management API reachable from outside the container if the port is published.
The discovery of this critical flaw has significant implications for organizations that rely on the Bifrost AI gateway for their AI-powered applications. According to JFrog, operators should upgrade to transports/v2.1.0, which returns 403 when an unauthenticated caller tries to register a stdio MCP client. Those who cannot upgrade immediately should set governance.auth_config.is_enabled to true, use strong credentials, and keep the management listener off untrusted networks.
It is also worth noting that operators on transports/v2.0.0 are still affected by the MCP flaw, and a second, related flaw found by Or Peles of the same research team was disclosed on September 6, CVE-2026-86242, which allows an unauthenticated attacker to register a custom plugin whose path is an HTTP URL. Bifrost downloads the file, writes it as a temporary shared object, and loads it through Go's plugin.Open function.
Both flaws share the same root cause: Bifrost's management API ships with authentication disabled by default. This pattern has already led to real-world attacks, as researchers disclosed a design flaw in MCP's STDIO transport that affects Anthropic's official SDKs in April 2026. A similar command-injection flaw in LiteLLM, another AI gateway, was actively exploited and added to CISA's Known Exploited Vulnerabilities catalog in June.
The discovery of these critical flaws in the Bifrost AI gateway serves as a reminder of the importance of rigorous security testing and the need for organizations to stay vigilant in the face of evolving cybersecurity threats. As the use of AI continues to grow, it is essential that security measures are in place to protect against such vulnerabilities and prevent unauthorized access to sensitive systems and data.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Critical-Flaw-in-the-Bifrost-AI-Gateway-A-Window-of-Vulnerability-for-Hackers-ehn.shtml
https://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.html
Published: Tue Sep 22 13:22:19 2026 by llama3.2 3B Q4_K_M
