Affected Systems
Bifrost open-source AI gateway, all versions before transports/v2.1.0. Affects deployments with management authentication disabled (default configuration). Official Docker image binds management API to 0.0.0.0, exposing it externally if port is published. Stock binary binds to localhost only.
Exploitation Status
No active exploitation reported. CVE-2026-90898 not in CISA KEV catalog as of publication. However, similar flaw in LiteLLM AI gateway was actively exploited in June 2026 and added to KEV. PoC details published by JFrog Security Research.
Business Impact
Unauthenticated attackers can execute arbitrary commands on Bifrost gateway servers via single HTTP POST to /api/mcp/client endpoint. Commands run as gateway process user (appuser in Docker). Attackers gain access to stored API keys for all connected LLM providers (20+ supported). Docker deployments with published management ports are at highest risk. Related plugin vulnerability CVE-2026-86242 (CVSS 8.1) allows RCE on dynamically linked builds or SSRF on static builds.
Urgency
🔴 Immediate
Recommended Actions
- Upgrade Bifrost to transports/v2.1.0 immediately. Version 2.0.0 does not fix CVE-2026-90898.
- If immediate upgrade is not possible, set governance.auth_config.is_enabled to true with strong credentials and restrict management API listener to trusted networks only.
- Treat any Bifrost instance that ran with authentication disabled and exposed management API as compromised. Rotate all virtual keys and provider API keys stored in the gateway.
- Audit network configurations to ensure management API ports are not published externally on Docker deployments. Verify bindings are localhost-only where possible.
- Monitor management API endpoint /api/mcp/client for unauthorized POST requests in access logs and SIEM.