Critical pre-auth RCE in Bifrost AI Gateway
On September 22, 2026, JFrog Security Research disclosed a critical remote-code-execution (RCE) flaw in Bifrost, an open-source AI gateway that aggregates requests to more than 20 large-language-model (LLM) providers. The vulnerability, cataloged as CVE-2026-90898 with a CVSS 9.8 score, allows an unauthenticated attacker to execute arbitrary commands on the gateway host with a single HTTP POST to the management endpoint /api/mcp/client. The exploit runs the supplied command as the gateway process user (appuser in the official Docker image), giving the attacker immediate access to stored provider API keys.
Why the default configuration is the real problem
Bifrost ships its management API with authentication disabled by default, a design choice that the developers justified as “convenient for local testing.” In practice, this assumption treats the management interface as a trusted internal component, ignoring the reality that many deployments run the official Docker image with the API bound to 0.0.0.0. When the container port is published, the unauthenticated endpoint becomes reachable from any network that can reach the host, effectively exposing a full-privilege command-execution vector to the internet. This mirrors a broader industry trend of shipping services with insecure defaults, a practice that repeatedly leads to high-impact breaches.
Technical walk-through of the MCP flaw
The attack leverages Bifrost’s support for “stdio-type” MCP (Management Control Protocol) clients. An attacker sends a POST request containing a JSON payload that specifies a command to run, for example:
{ "type": "stdio", "command": "id && cat /etc/passwd" }
Bifrost’s HTTP transport creates the client process before performing any MCP handshake, meaning the command is executed immediately under the gateway’s user account. Because the gateway stores LLM provider credentials in memory, the attacker can read those secrets after gaining shell access. The flaw is present in every transport version before 2.1.0 when the governance.auth_config.is_enabled flag remains false, which is the default.
Related plugin download issue (CVE-2026-86242)
A second vulnerability disclosed on September 6, 2026 (CVE-2026-86242, CVSS 8.1) compounds the risk. It permits an unauthenticated attacker to register a custom plugin whose source is an HTTP URL. Bifrost downloads the file, writes it as a temporary shared object, and loads it via Go’s plugin.Open. On dynamically linked builds—required for custom plugins—the malicious code runs as the gateway user, effectively providing another path to RCE. Statically linked builds, such as the official Docker image, fail at plugin.Open and only achieve server-side request forgery, but the underlying trust-model weakness remains.
Real-world relevance and precedent
The Bifrost MCP flaw is not an isolated curiosity. In April 2026, researchers identified a similar STDIO transport design flaw in Anthropic’s SDKs, and a command-injection bug in LiteLLM was actively exploited and added to CISA’s Known Exploited Vulnerabilities (KEV) catalog in June. While Bifrost’s CVEs have not yet entered the KEV list, the pattern of pre-auth RCEs in AI gateway software suggests a growing attack surface as organizations adopt multi-LLM orchestration layers.
Immediate mitigation steps
Operators should upgrade to transports/v2.1.0, which returns HTTP 403 for unauthenticated client registration attempts. For environments that cannot patch immediately, the following hardening measures are recommended:
- Set
governance.auth_config.is_enabledtotrueand configure strong, unique credentials for the management API. - Bind the management listener to
127.0.0.1or a private interface, preventing external reachability. - Review Docker run commands and ensure the management port is not published unless absolutely necessary.
- Rotate all LLM provider API keys and any virtual keys stored by the gateway, as JFrog advises treating exposed instances as compromised.
- Audit container images for any lingering custom plugins that may have been introduced before the fix.
Longer-term lessons for the AI-gateway ecosystem
The Bifrost incident forces a reassessment of a common industry assumption: that developers can safely ship services with authentication disabled for “ease of use.” The reality is that AI gateways sit at the nexus of high-value credentials and external traffic, making them prime targets for nation-state and financially motivated actors. Default-off security controls violate the principle of secure-by-default and shift the burden of protection onto downstream operators, many of whom lack the expertise to harden complex Go-based services.
Security teams should demand that open-source projects adopt secure defaults—authentication enabled, management interfaces bound to localhost, and explicit opt-out mechanisms for any convenience features. Vendors that distribute pre-built containers must audit their images for exposed management ports and provide clear documentation on how to lock down the service.
What to watch next
The disclosure timeline shows two critical flaws within a month, following an unrelated SSRF issue (CVE-2026-55245) fixed in August. This rapid succession hints at deeper architectural weaknesses that may surface in future audits. Analysts should monitor the Bifrost GitHub repository for additional patches and watch for any reports of active exploitation in the wild. Moreover, the broader AI-gateway market—LiteLLM, LangChain-Serve, and emerging proprietary solutions—should be scrutinized for similar default-off authentication patterns.
External references
The NIST vulnerability database lists both CVE entries, providing official severity metrics and vendor statements. For a deeper dive into the underlying Go plugin mechanism, see the relevant discussion on the GitHub Security Advisories.
Sponsored: For a comprehensive view of all known CVEs, consult the NIST vulnerability database.
Related coverage
- Cisco 0-Day Vulnerability Exposes Users to Remote Exploitation
- Cisco ISE zero-day Exploits API Endpoint Authentication
- Orkes Conductor CVE-2026-58138: Critical Pre-Auth RCE Actively Exploited