Executive brief
Bifrost is an AI gateway that manages model connections through its administrative API. When authentication is disabled (the default), an attacker can send an unauthenticated request to register a malicious MCP client, causing Bifrost to execute an arbitrary command on the server or access internal services. This grants complete control over the gateway and any systems it can reach.
Technical details
Bifrost's MCP client registration endpoint (/api/mcp/client) fails to enforce authentication checks before accepting stdio and HTTP/SSE client registrations. An unauthenticated attacker can POST a JSON payload specifying a stdio client with an arbitrary command, causing Bifrost to spawn that process as the appuser account; alternatively, they can register an HTTP or SSE client pointing to loopback or private-network addresses (169.254.169.254, RFC1918 ranges), enabling SSRF. The vulnerability exists when governance.auth_config.is_enabled is false (default). Patch released in transports/v2.1.0 refuses unauthenticated stdio registrations with HTTP 403; transports/v2.0.0 remains vulnerable. No authentication, user interaction, or network restrictions are required to exploit.
Affected products
- Bifrost Bifrost transports/v2.0.0 and earlier
Timeline
- 2026-09-14: disclosed: CVE-2026-90898 published
- 2026-09-02: patched: Fix committed in transports/v2.1.0 with authentication and SSRF checks