Bifrost CVE-2026-90898 Grants Unauthenticated RCE via MCP stdio Registration on Default Docker Exposure
Bifrost's default unauthenticated management API on Docker creates remote command execution that directly exposes LLM provider keys. The flaw mirrors previously exploited AI gateway patterns and remains outside CISA KEV. Affected operators must rotate credentials after patching to 2.1.0.
The root cause is Bifrost's management API shipping with governance.auth_config.is_enabled false by default. On the official Docker image the listener binds 0.0.0.0, so any published port is reachable from the network. A single request starts the attacker-chosen command before any MCP handshake completes, granting direct access to stored credentials. Transports/v2.0.0 fixed an earlier plugin issue but left this path open; only 2.1.0 returns 403.
JFrog's disclosure aligns with the April 2026 MCP stdio transport design flaw that affected Anthropic SDKs and the June 2026 LiteLLM command-injection campaign added to CISA KEV. Both prior cases showed unauthenticated gateways becoming credential harvesters once exposed. The second Bifrost flaw, CVE-2026-86242, compounds the pattern by allowing unauthenticated plugin downloads that execute on dynamically-linked builds.
Operators running 1.6.x through 2.0.0 with the management port reachable must treat instances as compromised. Evidence from the LiteLLM incident indicates active scanning begins within days of disclosure. Immediate steps are upgrade to 2.1.0, enforce strong auth, and rotate every virtual and provider key. No independent technical attribution of exploitation yet exists.
CISA: CVE-2026-90898 added to KEV catalog within 45 days of disclosure
Sources (3)
- [1]JFrog Security Research Advisory(https://research.jfrog.com/vulnerabilities/bifrost-mcp-2026/)
- [2]The Hacker News Original Report(https://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.html)
- [3]CISA Known Exploited Vulnerabilities Catalog(https://www.cisa.gov/known-exploited-vulnerabilities-catalog)