Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials

Summary

JFrog Security Research's Yuval Moravchick found CVE-2026-90898 (CVSS 9.8) in Bifrost, an open-source AI gateway. Before 2.1.0 with management authentication disabled, which is the default, a single unauthenticated POST to /api/mcp/client registers a stdio MCP client, and Bifrost runs the specified command as the gateway process user before any MCP handshake. Because the gateway stores API keys for every connected provider, the attacker gains access to those credentials.

Mitigation

Upgrade to transports/v2.1.0, which returns 403 for unauthenticated stdio MCP client registration. If upgrading is not immediately possible, set governance.auth_config.is_enabled to true, use strong credentials, and keep the management listener off untrusted networks. JFrog advises treating any instance that ran with authentication disabled and an exposed management API as compromised and rotating virtual keys and provider API keys.

Topics

• Model Context Protocol

Related items

• MediumCVE-2026-127202: MLflow path traversal through model_id in the log outputs APISimilar attack · NVD/CVE Database
• MediumTrained to betray: How post-training supply chain attacks hijack coding agentsSimilar attack · Microsoft Security Blog
• LowAI chatbots are recommending fake retail websites, study findsSimilar attack · The Verge (AI)
• MediumPalo Alto tracks a massive Chinese AI attack that sadly lives up to industry fearsSimilar attack · CSO Online
• MediumAttackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society SectorsSimilar attack · Palo Alto Unit 42