Artificial Intelligence · Cybersecurity
Bifrost flaw lets attackers run commands without credentials
Researchers said a flaw in Bifrost’s management API let an unauthenticated attacker register an MCP client and run commands on the gateway server, with fixes available in later releases.
- JFrog Security Research said CVE-2026-90898 affected Bifrost HTTP transport releases before 2.1.0 when management authentication was turned off.
- Yuval Moravchick said an attacker could send one unauthenticated request to register a stdio-type MCP client and start a command as the gateway process user.
- The article said the official Docker image exposed the management API on 0.0.0.0 and that Bifrost stored API keys for connected providers.
- JFrog said operators should move to transports/v2.1.0, and those unable to upgrade should enable authentication, use strong credentials and keep the listener off untrusted networks.
- The article also said Or Peles disclosed a related flaw, CVE-2026-86242, on 6 September, and that neither Bifrost CVE was in CISA's KEV catalog at publication.
JFrog Security Research said Bifrost had a critical flaw, tracked as CVE-2026-90898, in its HTTP transport. The issue affected versions before 2.1.0 when management authentication was disabled, which the article said was the default setting.
Yuval Moravchick said an attacker could register a stdio-type MCP client through one unauthenticated POST request to the management API endpoint /api/mcp/client. Bifrost then started the command at once, running it as the gateway process user.
The article said the official Docker image used appuser and exposed the management API on 0.0.0.0 if the port was published. It also said Bifrost stored API keys for connected providers, so command execution on the gateway could expose those credentials.
JFrog said transports/v2.1.0 fixed the issue by returning 403 to unauthenticated registration attempts. It also said operators with exposed, unauthenticated instances should treat them as compromised and rotate virtual keys and provider API keys.
Named in this story
People
- Yuval Moravchick
- the researcher who found the flaw
- Or Peles
- the researcher who found a related flaw
Companies
- Anthropic
- the company whose official SDKs were cited in a related MCP issue
Organisations
- JFrog Security Research
- the team that discovered and described the flaw
Governments and agencies
- CISA
- the agency that added the LiteLLM issue to its KEV catalog
Products and systems
- Bifrost
- the AI gateway affected by the flaw
- CVE-2026-90898
- the identifier assigned to the main vulnerability
- transports/v2.1.0
- the version that fixes the main flaw
- CVE-2026-86242
- the identifier assigned to the related vulnerability
- LiteLLM
- another AI gateway cited as having a similar flaw
How the source tells it
The piece is a straightforward security notice with a brief urgent register from the severity rating and remedial instructions.
- urgency The severity rating and repeated instructions to upgrade, restrict access, and rotate keys push the reader towards immediate action