Tracking: CVE-2026-90898
Severity: Critical
Who is affected
Bifrost HTTP transport before 2.1.0, with management authentication disabled or unconfigured and the management interface reachable by an attacker.
How the attack works
The management API accepts a stdio MCP client registration containing a command. Bifrost immediately starts that command as the gateway process user. Without an authentication check at registration, the caller obtains operating-system execution through what appears to be a configuration operation.
The impact depends on the gateway account and its environment. Model-provider keys, configuration, mounted files, and reachable internal services may be exposed where the process can access them.
What to do
- Upgrade the HTTP transport to 2.1.0 or later and enable management authentication.
- Restrict the management listener to trusted administration paths. Review MCP client registrations and commands that were started before remediation.
- If an exposed instance shows suspicious registrations or execution, rebuild affected runtime state and rotate credentials it could access.
Scope and limits
The vulnerable management interface must be reachable and lack the required authentication. Do not broaden this to every authenticated Bifrost deployment.