Executive brief
Bifrost is an AI gateway that supports custom plugins loaded as native code (.so files). When management authentication is disabled (the default), attackers can POST a malicious plugin to an unauthenticated API endpoint that downloads and executes arbitrary native code in the gateway process. On dynamically linked builds, this results in immediate remote code execution; on the published static Docker image, it causes server-side request forgery instead. Successful exploitation requires a plugin binary matching the target's Go version, OS, and architecture.
Technical details
The vulnerability exists in the POST /api/plugins endpoint, which accepts a custom plugin configuration with an HTTP URL in the path field when governance.auth_config.is_enabled is false (the default). The shared-object loader treats http-prefixed paths as download URLs, fetches them without authentication, writes the body to a temporary .so file, and passes it to Go's plugin.Open(). On dynamically linked builds (which the vendor requires for custom Go plugins), plugin.Open succeeds and the plugin's Init() function executes immediately with the Bifrost process privileges. The attack is unauthenticated and network-reachable. Attack complexity is high because the malicious .so must match the target's Go version, OS, architecture, and linkage model. The 1.6.x line through 1.6.11 and all versions before 2.0.0 are affected. A patch requiring genuine authentication and SSRF-hardened downloads is available in 2.0.0+.
Affected products
- MaximHQ Bifrost before 2.0.0, including all 1.6.x versions through 1.6.11
Timeline
- 2026-09-06: disclosed: CVE-2026-86242 published
- 2026-08-03: patched: Fix merged in commit e0057ff (included in 2.0.0+)