Bifrost CVE-2026-90898: An MCP Endpoint Became a Command Interface

Bifrost has fixed CVE-2026-90898, a critical vulnerability that allowed an unauthenticated request to start an operating-system command on certain exposed AI gateways.

The vulnerable management endpoint could register an MCP client using the standard-input-and-output transport. That registration included a command and its arguments. Bifrost then started the process as the gateway’s operating-system user.

The vulnerability did not affect every deployment equally. The documented remote path required a reachable management interface and disabled or unconfigured dashboard authentication.

Operators should nevertheless upgrade to Bifrost HTTP transport 2.1.0 or later, verify their actual management-plane exposure, investigate affected environments, and rotate provider and virtual keys when prior compromise cannot be excluded.

Key takeaways

How does CVE-2026-90898 work?

Bifrost is an AI gateway that can route application requests across models and providers.

Its management API supports the registration of Model Context Protocol clients. An MCP client using the stdio transport is represented by:

• A local command.
• Command-line arguments.
• The tools the client may expose.

The gateway starts that process locally so it can communicate with the MCP server over standard input and output.

JFrog found that when management authentication was disabled, an unauthenticated caller could submit a request to /api/mcp/client and register a stdio client containing an arbitrary command.

Bifrost started the command as the gateway process user without waiting for a successful MCP handshake.

Execution path

Which versions are affected?

JFrog identifies Bifrost HTTP transport versions before 2.1.0 as vulnerable.

Version 2.1.0 rejects unauthenticated stdio registration with an HTTP 403 response when dashboard authentication is disabled or unconfigured.

Important version distinctions include:

Bifrost separately addressed CVE-2026-86242, involving unauthenticated custom-plugin registration, in version 2.0.0. Operators need 2.1.0 or later to address both issues.

Is every Bifrost deployment remotely exploitable?

No.

Bifrost says the remote paths require both:

A private deployment or one with properly configured authentication is not exposed through the documented remote conditions.

However, “private” should be verified from the running environment—not assumed from the architecture diagram.

Administrators should confirm:

• Which interfaces the management service binds to.
• Whether Docker publishes the management port.
• Whether load balancers or ingress controllers expose it.
• Whether tunnels, development proxies, or port-forwarding rules exist.
• Whether authentication is active in the running configuration.
• Whether internal users, workloads, contractors, or vendor networks can reach it.
• Whether test and disaster-recovery systems use weaker settings.

Bifrost notes that Docker deployments deserve particular attention because the API may bind to 0.0.0.0. The vendor says it is changing that behavior to use localhost when dashboard authentication has not been configured.

→ Audit Your Bifrost Exposure

Why is an AI gateway compromise consequential?

An AI gateway may sit between production applications and multiple model providers.

Management-plane exposure

Data-plane and operating-system scope

Bifrost says provider and virtual keys are encrypted at rest and are not returned through ordinary APIs.

The question is therefore not only what Bifrost’s API returns.

It is what the Bifrost operating-system process can reach.

What should Bifrost operators do?

1. Upgrade to version 2.1.0 or later

Upgrade the Bifrost HTTP transport and verify the version from the running environment after deployment.

2. Separate the management plane

The gateway’s application-facing data plane may need to receive requests from production workloads. Its management API does not need the same exposure.

Keep management services on private interfaces where possible and protect them with:

• Firewalls and security groups.
• Private ingress.
• VPN or identity-aware access.
• Administrative network segmentation.
• Restricted container port mappings.

3. Enable and test authentication

Configure strong dashboard and management authentication.

Do not stop after confirming that the setting exists. Test that an unauthenticated request to the management endpoint fails.

Bifrost also recommends configuring its setup token so that an exposed instance cannot be claimed by the first person who reaches the initial administrator-registration process.

4. Investigate exposed instances

Review:

• Gateway and reverse-proxy logs.
• Container and orchestration events.
• Operating-system telemetry.
• Endpoint or workload detection.
• Network connections.
• Configuration history.
• MCP client registrations.
• Child-process creation.

Look for unexpected stdio clients, new files, shell activity, unexplained outbound connections, configuration changes, and access to provider endpoints or secrets.

5. Rotate associated authority

If the management interface was internet-facing while authentication was disabled, JFrog recommends treating the instance as compromised.

Rotate:

• Bifrost virtual keys.
• Model-provider API keys.
• Relevant monitoring credentials.
• Any additional secrets accessible to the gateway process.

Rotate them at the issuing systems and review usage under the previous credentials for unexpected models, volumes, locations, or applications.

→ Verify Your AI Gateway Management Plane

The Infonaligy perspective

MCP stdio is not merely a messaging option. It is a controlled process-execution capability.

That capability needs a stronger boundary than ordinary model-routing traffic.

Organizations should separate gateway data-plane access from management authority, authenticate every administrative operation, document the secrets available at runtime, and monitor process creation on gateway hosts.

A private network reduces exposure. It does not prove that a vulnerable service was never reachable.

Infonaligy’s AI consulting services, Cloud Infrastructure services, and SOC Services help organizations connect AI architecture with identity, network boundaries, credential management, monitoring, and incident readiness.

Conclusion

CVE-2026-90898 demonstrates how quickly an AI integration feature can cross into operating-system security.

Bifrost operators should upgrade to version 2.1.0 or later, verify management-interface reachability, test authentication, investigate exposed systems, and rotate the authority those systems carried.

Recovery is complete only when both the gateway host and its connected credentials can be trusted.

→ Assess Your Runtime Credential Risk

Frequently asked questions

Primary sources

• JFrog Security Research
• Bifrost security update