CVE-2026-90898 in Bifrost
Summary
by MITRE • 09/14/2026
Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.
The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).
transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability in question stems from a critical misconfiguration and architectural flaw within the Bifrost management API, specifically regarding how Model Context Protocol clients are registered and executed. The core issue lies in the handling of stdio-based MCP clients, which operate by executing a specified command along with its arguments directly on the host system where the gateway resides. Unlike standard networked protocols that require an explicit handshake or authentication phase before establishing a session, Bifrost initiates the execution of these client programs immediately upon their registration via the management API. This design choice bypasses traditional security boundaries by treating any successful API call as sufficient authorization to spawn processes with elevated privileges inherent to the application user account.
The severity of this vulnerability is heavily dependent on the authentication configuration settings, specifically the governance.auth_config.is_enabled parameter. By default, this setting is disabled, meaning that every caller interacting with the management API is implicitly treated as a local administrator. In such an unauthenticated state, there are no access controls to restrict who can register new MCP clients. Consequently, any external actor or malicious script capable of sending a POST request to the /api/mcp/client endpoint gains immediate and unrestricted ability to execute arbitrary commands on the underlying system. This effectively results in remote code execution with the privileges of the Bifrost process user, which is typically appuser in official container images but could be root or another high-privilege account depending on deployment specifics.
The operational impact of this flaw is severe, as it allows for complete compromise of the host environment running the Bifrost gateway. An attacker can leverage this to install malware, exfiltrate sensitive data, pivot into other network segments, or disrupt service availability by consuming system resources through maliciously crafted commands. The lack of a handshake requirement means that exploitation does not require complex interaction sequences; a single HTTP POST request is sufficient to trigger the execution pipeline. This simplicity makes automated scanning and widespread exploitation highly feasible for threat actors targeting exposed management interfaces.
It is important to note that this vulnerability exhibits version-specific behavior within the transport layer implementations. While newer versions such as transports/v2.1.0 have implemented safeguards by refusing unauthenticated stdio registrations with a 403 Forbidden response, older versions like transports/v2.0.0 remain vulnerable and continue to allow these unauthorized executions. This discrepancy highlights the importance of keeping all components updated but also underscores that systems running legacy transport layers are at immediate risk if authentication is not explicitly enforced through other means.
To mitigate this vulnerability, organizations must ensure that governance.auth_config.is_enabled is set to true in production environments. Enabling authentication forces all API interactions to undergo proper identity verification and authorization checks before any actions are taken. Additionally, administrators should restrict network access to the management API endpoints using firewalls or reverse proxies to limit exposure only to trusted administrative IPs. Regular auditing of registered MCP clients and monitoring for unexpected process spawns can also help detect potential exploitation attempts early. Given that this flaw aligns with CWE-287 Improper Authentication and CWE-94 Command Injection, addressing these configuration gaps is essential for maintaining the integrity and security of the infrastructure hosting Bifrost services.