Bifrost AI gateway CVE-2026-90898 (CVSS 9.8) unauth RCE via MCP stdio client registration — fix transports/v2.1.0

JFrog Security Research (CVE published 14 September 2026; industry wire 22 Sep) documents CVE-2026-90898 in MaximHQ Bifrost (open-source AI gateway / HTTP transport): with default governance.auth_config.is_enabled=false, an unauthenticated POST /api/mcp/client registering a stdio-type MCP client starts attacker-chosen command+args as the Bifrost process user before any MCP handshake. JFrog/CNA CVSS 3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CWE-306/284. Stock binary binds management API to localhost by default; official Docker image binds 0.0.0.0 so published ports expose the management API. Fix: transports/v2.1.0 returns 403 for unauthenticated stdio registration (PR #6757). Affected: Bifrost HTTP transport < 2.1.0; 1.6.x through 1.6.11 and transports/v2.0.0 lack the fix. Workaround: enable management auth and firewall the listener; treat previously exposed unauth instances as compromised and rotate virtual keys/provider credentials. Primary: JFrog advisory; metadata: CVE.report; wire: The Hacker News 22 Sep 2026.

Product

MaximHQ Bifrost AI gateway HTTP transport (github.com/maximhq/bifrost/transports)

Versions

Affected: HTTP transport < 2.1.0 when management auth disabled (default); 1.6.x ≤1.6.11 and transports/v2.0.0 lack fix. Fixed: transports/v2.1.0+

CVSS

9.8 (CVSS 3.1 Critical; JFrog/CNA)

Exploited in Australia?

unknown

Patch to

Upgrade Bifrost HTTP transport to ≥2.1.0; until then set governance.auth_config.is_enabled=true with strong admin credentials and keep management API off untrusted networks; if Docker published 0.0.0.0 with auth off, assume compromise and rotate provider/virtual keys

Primary: JFrog — Bifrost unauth RCE via MCP stdio (CVE-2026-90898) · Vendor: Bifrost — transports/v2.1.0 release (fix) · CVE: CVE-2026-90898 · CVE.report — CVE-2026-90898; also The Hacker News 22 Sep 2026

vulnerabilities ai cloud