Bifrost AI Gateway RCE Risk: Authentication Disabled by Default

On September 22, 2026, JFrog Security Research disclosed a critical vulnerability in the open-source Bifrost AI gateway that allows unauthenticated arbitrary remote command execution. The combination of an unprotected MCP stdio management endpoint and authentication disabled from installation turns every exposed Docker container into a potential total compromise vector, with direct access to API keys for more than 20 LLM providers.

The Mechanism: MCP stdio as Immediate Execution Vector

Bifrost acts as a gateway for routing AI requests to more than 20 LLM providers. Anthropic's Model Context Protocol (MCP) allows registration of "clients" that extend model capabilities. Among supported client types, the stdio type launches an external process by specifying an arbitrary command.

The vulnerability resides in the registration flow via the POST /api/mcp/client endpoint. According to the technical discovery documentation, Bifrost launches the specified command immediately, before any MCP handshake, executing it as the gateway process user. This "immediate registration" mechanism bypasses any intermediate security controls and enables direct Remote Code Execution.

The issue is classified as CWE-306: Missing Authentication for Critical Function. The official CVE record reports the full CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — remote attack, low complexity, no privileges required, no user interaction, maximum impact on confidentiality, integrity, and availability.

"A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request." — The Hacker News

The "Dangerous Default": When Official Docker Amplifies Risk

The most problematic design choice is not technical but architectural: management authentication is disabled by default. The official CVE record states succinctly: "Auth off means every caller is a local admin." This configuration, apparently intended to simplify first launch, turns every unreconfigured instance into a server with open administrative privileges.

The distinction between stock binary and containerization is crucial. The precompiled binary binds the management API to localhost, limiting exposure to the local machine. The official Docker image binds to 0.0.0.0 instead, making the API reachable from outside the container if the port is published. Given the prevalence of containerized deployments in modern AI infrastructure, this discrepancy transforms a local vulnerability into a network-attack vector.

Execution occurs as the appuser user in the official Docker image. Because the gateway stores API keys for every connected provider, compromise of the gateway process grants immediate access to those credentials — with potential abuse of AI resources at potentially high cost to victim organizations.

The Version Chain: What Is Fixed and What Is Not

Patch management presents a complication that operators must track precisely. According to The Hacker News, citing release status directly:

• transports/v2.1.0: fixes both vulnerabilities. The official CVE record confirms this version "refuses an unauthenticated stdio registration with 403"; GitHub PR #6757 implements the rejection.
• transports/v2.0.0: fixes only CVE-2026-86242 (HTTP URL plugin loading, CVSS 8.1), but "still allows it" regarding CVE-2026-90898. Operators on 2.0.0 remain exposed.
• 1.6.x line through 1.6.11: lacks both fixes. According to the primary source, "The 1.6.x line through 1.6.11 contains neither fix."

The second vulnerability, CVE-2026-86242 with CVSS 8.1 HIGH, was discovered by Or Peles of the same JFrog team and concerns plugin loading from HTTP URLs. Although relevant, the dossier does not document quantified impacts in real-world scenarios for this second flaw.

Immediate Actions

The JFrog Security Research team has issued specific recommendations that operators can translate into immediate actions:

1. Upgrade to transports/v2.1.0 or higher: this is the only version that blocks unauthenticated stdio registration with a 403 response.
2. Explicitly enable management authentication by setting governance.auth_config.is_enabled=true in configuration, even on versions that cannot be upgraded immediately.
3. Consider instances with authentication disabled and exposed management API compromised, with consequent rotation of API keys stored in the gateway.
4. Verify binding address in containerized deployments: if the management API must not be externally accessible, restrict exposure to internal interfaces or the container itself.

A Systemic Pattern: MCP stdio in the AI Threat Landscape

The Bifrost vulnerability is not isolated. The pattern of command injection through the MCP stdio client type is emerging as a systemic vector in the AI infrastructure ecosystem. Analogous precedents are documented in Anthropic and LiteLLM implementations, indicating that defenders must specifically monitor this extension mechanism.

The distinguishing characteristic is "early" execution: the command launches before any validation of the MCP protocol itself. This design, apparently optimized for responsiveness, sacrifices security for latency. The absence of authentication by default amplifies the design flaw into a critical vulnerability.

The dossier does not specify the exact number of Bifrost instances exposed on the Internet, nor does it document active in-the-wild exploits. CVE-2026-90898 is not present in the CISA KEV catalog at time of publication. However, the combination of CVSS 9.8, common Docker exposure, and absent authentication requires operators to treat this vulnerability with maximum priority regardless of active exploitation confirmation.

Frequently Asked Questions

Why is the stock binary less exposed than the Docker container?

The precompiled binary binds the management API to localhost by default, limiting access to the local machine. The official Docker image binds to 0.0.0.0, extending the attack surface to all available network interfaces when the port is published.

Can I mitigate without upgrading?

Explicitly enabling management authentication reduces the attack surface, but the dossier does not document this as a complete mitigation equivalent to the patch. Upgrading to transports/v2.1.0 remains the definitive corrective action according to sources.

What is my risk if I already exposed the management API without authentication?

According to the primary source, JFrog advises considering such instances compromised and proceeding with rotation of stored API keys. The gateway holds credentials for every configured LLM provider; their exposure enables direct abuse of resources at the victim's expense.

Sources

• https://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.html
• https://www.bleepingcomputer.com/news/security/wordpress-click2shell-flaw-lets-hackers-execute-php-on-the-server/
• https://www.bleepingcomputer.com/news/security/check-point-patches-management-server-zero-day-exploited-in-attacks/
• https://blog.netmanageit.com/critical-bifrost-ai-gateway-flaw-lets-attackers-run-commands-without-credentials/
• https://www.guardianmssp.com/2026/09/22/critical-bifrost-ai-gateway-flaw-lets-attackers-run-commands-without-credentials/
• https://www.cve.org/CVERecord?id=CVE-2026-90898
• https://nvd.nist.gov/vuln/detail/cve-2026-93616
• https://support.checkpoint.com/results/download/145601
• https://support.checkpoint.com/results/sk/sk1000171/#:~:text=Indication%20of%20Compromise
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-24919