Bifrost AI Gateway Flaw Enables Remote Code Execution

Critical vulnerability exposes LLM credentials

A severe security flaw in Bifrost, an open-source gateway that routes requests across more than 20 large language model providers, permits unauthenticated attackers to execute arbitrary commands on the server and access stored API credentials.

The vulnerability, designated CVE-2026-90898 with a CVSS score of 9.8, stems from Bifrost's default configuration that ships with management authentication disabled. All versions of the Bifrost HTTP transport prior to 2.1.0 are affected when running in this default state.

Yuval Moravchick of JFrog Security Research discovered the flaw and reported that an attacker needs only a single unauthenticated POST request to the management API endpoint /api/mcp/client to register a stdio-type MCP client. Bifrost immediately executes the specified command as the gateway process user—before any MCP handshake occurs.

Because Bifrost stores API keys for every connected LLM provider, command execution on the gateway process grants attackers direct access to these credentials. On the official Docker image, the process runs as appuser and the management API binds to 0.0.0.0, making it reachable from outside the container if the port is published.

Why it matters

This vulnerability represents a systemic risk for organizations using AI gateways to manage access to multiple LLM providers. A single exposed instance can compromise credentials for dozens of commercial AI services, potentially leading to unauthorized usage charges, data exfiltration through prompt injection, or poisoning of model fine-tuning datasets. The pattern of authentication-disabled defaults in AI infrastructure tools suggests the industry has not yet internalized lessons from decades of secure-by-default design principles.

Second flaw compounds exposure

JFrog researcher Or Peles identified a related vulnerability disclosed September 6. CVE-2026-86242, scored at 8.1, allows unauthenticated attackers to register a custom plugin by providing an HTTP URL. Bifrost downloads the file, writes it as a temporary shared object, and loads it through Go's plugin.Open function.

On dynamically linked builds—required for custom Go plugins—the plugin code executes as the gateway process user. On statically linked builds, including the official Docker image, the operation fails but still results in server-side request forgery. A fix shipped in transports/v2.0.0.

Remediation steps

Operators should upgrade to transports/v2.1.0, which returns a 403 error when unauthenticated callers attempt to register stdio MCP clients. Organizations unable to upgrade immediately must set governance.auth_config.is_enabled to true, use strong credentials, and ensure the management listener is not exposed to untrusted networks.

JFrog recommends treating any instance that ran with authentication disabled and an exposed management API as compromised. All virtual keys and provider API keys should be rotated.

Versions on transports/v2.0.0 remain vulnerable to the MCP flaw; that release addressed only an earlier plugin vulnerability. The 1.6.x line through 1.6.11 contains neither fix.

Pattern of AI gateway vulnerabilities

These flaws mark the second and third security issues disclosed in Bifrost within a month, following an unrelated SSRF vulnerability (CVE-2026-55245) patched in late August. The MCP command-injection pattern has already led to real-world exploitation: a similar flaw in LiteLLM, another AI gateway, was actively exploited and added to CISA's Known Exploited Vulnerabilities catalog in June 2026.

Neither Bifrost CVE appears in the KEV catalog as of this writing.

These details were first reported by The Hacker News, based on research from JFrog Security.