Bifrost AI Gateway — Critical Unauthenticated Remote Code Execution and SSRF Vulnerabilities (CVE-2026-90898)

Publication date: September 22, 2026
Category: Threat Intelligence / AI Vulnerabilities

Introduction

Security researchers at JFrog Security Research have uncovered multiple critical vulnerabilities in Bifrost, an open-source AI gateway designed to route requests to more than 20 Large Language Model (LLM) providers. Among the findings, CVE-2026-90898 stands out as a severe flaw allowing an unauthenticated attacker to execute arbitrary commands on the gateway server through a single HTTP request. This disclosure marks the latest in a series of security issues discovered in the project in under a month, highlighting the inherent risks of permissive default configurations in production-grade AI infrastructures.

What is Bifrost AI Gateway? (General Analysis)

Bifrost serves as a centralized intermediary or gateway to manage API traffic toward multiple AI providers, consolidating routing logic, authentication keys, and governance policies. Typically positioned with high visibility or connectivity within enterprise architectures, it handles highly sensitive information, including master credentials and access tokens for various cognitive model services.

The identified vulnerabilities severely compromise this control core:

  • CVE-2026-90898: Critical access control and command execution flaw. Official CVSS v3.1 score: 9.8 (CRITICAL). Exact vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Official CWE classification: CWE-284 (Improper Access Control) and CWE-306 (Missing Authentication for Critical Function). Confirmed NVD data.
  • CVE-2026-86242: Custom plugin loading flaw via HTTP URLs. Official CVSS v3.1 score: 8.1 (HIGH). Exact vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Official CWE classification: CWE-94 (Improper Control of Generation of Code), CWE-284, and CWE-306. Confirmed NVD data.
  • CVE-2026-55245: Server-Side Request Forgery (SSRF) vulnerability in image/document routing components. Official CVSS v4.0 score: 8.7 (HIGH). Exact vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. Official CWE classification: CWE-918 (Server-Side Request Forgery). Confirmed NVD data.

How Does It Work? (Technical Analysis)

The primary attack vector stems from a combination of default-disabled authentication configurations (governance.auth_config.is_enabled = false) and input validation flaws within the HTTP transport management interfaces.

  • Exploitation Flow of CVE-2026-90898 (MCP Stdio Client Registration):

    • Bifrost registers Model Context Protocol (MCP) clients through its management API endpoint (/api/mcp/client).
    • A stdio-type client requires the definition of a command along with its arguments.
    • Due to the absence of authentication and prior MCP handshake requirements in vulnerable versions (prior to transports/v2.1.0), the gateway immediately launches the specified program.
    • The child process runs directly with the privileges of the Bifrost process user (e.g., appuser on the official Docker image), enabling arbitrary command execution and the extraction of provider API keys stored in memory or configuration files.

  • Exploitation Flow of CVE-2026-86242 (Custom Plugin HTTP Path):

    • Bifrost’s HTTP transport (versions prior to 2.0.0) accepts custom plugins whose path is an HTTP URL via POST /api/plugins requests.
    • The shared-object loader treats the http-prefixed path as a download URL, writes the body to a temporary .so file, and processes it via Go’s plugin.Open function.
    • On dynamically linked builds, this results in remote code execution; on static builds (such as the official default Docker image), the loader fails, restricting the impact to an advanced SSRF scenario.

  • SSRF Mechanism (CVE-2026-55245):

    • The isPublicIP function in routing logic (utilized for Bedrock and Vertex endpoints) incorrectly classified special address blocks (such as Carrier-Grade NAT, IPv6 6to4 prefixes, NAT64, and deprecated site-local addresses) as public IPs.
    • This allowed an attacker controlling multimodal request URLs to force the gateway to fetch internal cloud infrastructure services, including instance metadata endpoints.

Affected Systems / Environments

Impact is concentrated on deployments utilizing unhardened default configurations (management authentication disabled) and exposure of administrative ports to external interfaces.

CVECategory (CWE)ImpactCVSSVector (Summary)
CVE-2026-90898CWE-284, CWE-306Critical (Unauthenticated RCE)9.8AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-86242CWE-94, CWE-284, CWE-306High (Plugin RCE / SSRF)8.1AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (with dynamic linkage)
CVE-2026-55245CWE-918High (SSRF to internal infrastructure)8.7AV:N/AC:L/AT:N/PR:N/UI:N/VI:H (CVSS v4.0)
  • Affected Software Versions:
    • Bifrost HTTP transport prior to version 2.1.0 (for CVE-2026-90898).
    • Bifrost HTTP transport prior to version 2.0.0 (for CVE-2026-86242).
    • Codebase line prior to 1.5.17 (for CVE-2026-55245).
  • At-Risk Environments: Docker containers executed using the official image (which binds the management API to 0.0.0.0 by default) and deployments with governance policies disabled.

Mitigation and Detection

Remediation

  1. Priority Update: Immediately upgrade the Bifrost HTTP transport to version 2.1.0 or higher, which implements strict rejections (HTTP 403 status code) for unauthenticated stdio MCP client registration attempts.
  2. Configuration Hardening: Explicitly enable access control mechanisms by setting governance.auth_config.is_enabled = true and enforcing strong credentials if immediate upgrading is unfeasible.
  3. Network Restriction: Ensure that Bifrost management API ports are never exposed to public or untrusted networks (avoid generic bindings to 0.0.0.0 in production environments).
  4. Secret Rotation: Treat any instance that operated with disabled authentication and an exposed management API as fully compromised, immediately rotating all integrated provider API keys and virtual tokens.

Detection

  • Monitor access logs for unauthorized POST requests directed at /api/mcp/client or /api/plugins.
  • Audit unexpected child processes spawned by the application container user (appuser).

Defensive Intelligence Note: The exposure of AI gateways featuring agent-based architectures and dynamic communication protocols (such as MCP) represents a critical lateral movement vector. Defensive teams must rigorously audit network parameters and authentication directives across any cognitive model gateway deployed within perimeter networks.

Wrapping Up

The vulnerabilities discovered in Bifrost emphasize the inherent risks of maintaining permissive default configurations in modern AI infrastructure tooling. With critical scores up to 9.8 and unauthenticated remote code execution vectors, the combination of an exposed management API and the ability to register arbitrary clients or plugins endangers not only server integrity but also all integrated model provider credentials. Prompt patching and strict enforcement of authentication policies are indispensable to neutralize these threats.

References