CVE-2026-86242Disclosure

Auth is off by default. One unauthenticated POST -> shell. 🚨 Two unauthenticated RCEs in the Bifrost AI Gateway, found by JFrog Research 🚨 Technical details >> https://research.jfrog.com/vulnerabilities/bifrost-is-vulnerable-to-unauthenticated-remote-code-execution-via-mcp-stdio-client-registration-cve-2026-90898/ https://research.jfrog.com/vulnerabilities/bifrost-is-vulnerable-to-unauthenticated-remote-code-execution-via-a-custom-plugin-http-path-on-dynamically-linked-builds-cve-2026-86242-jfsa-2026-001684572/ https://t.co/Wes8gZsURN

🚨 CVE-2026-86242 - high 🚨 Bifrost < 1.6.3 - Unauthenticated Remote Plugin URL Fetch > When dashboard authentication is disabled, Bifrost accepts an enabled custom plugin w... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-86242 @pdnuclei #NucleiTemplates #cve

⚠️ AI GATEWAY SECURITY — A NEW BIFROST FLAW CAN TURN AN UNAUTHENTICATED PLUGIN REQUEST INTO REMOTE CODE EXECUTION The vulnerability was publicly disclosed today and affects dynamically linked Bifrost deployments running versions before 2.0.0. CyberSignal Priority: 🟠 HIGH CVE: CVE-2026-86242 Product: Maximhq Bifrost Component: Bifrost HTTP transport / custom plugins CVSS 3.1: 8.1 HIGH Attack vector: NETWORK Privileges required: NONE User interaction: NONE Fixed: 2.0.0 CNA: JFrog Disclosure: September 6, 2026 ### 🔎 What happened Bifrost's management API can accept custom plugins through: POST /api/plugins When management authentication is disabled — the default configuration at disclosure — an unauthenticated attacker can supply an HTTP URL as the plugin path. Bifrost can then: download the remote object ↓ write it as a temporary `.so` ↓ pass it to Go's `http://plugin.Open` ↓ execute the plugin's optional `Init` function. On a dynamically linked Bifrost build capable of loading custom Go plugins, that creates a path to: UNAUTHENTICATED REMOTE CODE EXECUTION. The malicious code executes with the privileges of the Bifrost process. ### ⚠️ Critical deployment caveat This is NOT equivalent to universal RCE against every Bifrost installation. The published statically linked Docker image cannot dynamically load the downloaded Go plugin. In that deployment class: RCE → NOT EXPECTED but: SSRF → REMAINS POSSIBLE. Successful RCE also requires the attacker to create a compatible Go plugin matching the target's: • Go version • operating system • CPU architecture • linkage configuration. That requirement explains the HIGH attack-complexity rating. ### 🎯 Affected Bifrost HTTP transport: < 2.0.0 The 1.6.x line through: 1.6.11 does not contain the security fix. Linux and macOS dynamic-plugin deployments are specifically relevant. ### 🛡️ Defender action → Upgrade to Bifrost 2.0.0 or later → Enable management authentication: `governance.auth_config.is_enabled=true` → Restrict network access to `/api/plugins` → Identify dynamically linked deployments that permit custom Go plugins → Review unexpected plugin creation and outbound HTTP activity ### ⚠️ Exploitation status Confirmed exploitation in the wild: NOT ESTABLISHED. CISA KEV: NOT LISTED at the time of this post. Do not label this ACTIVE EXPLOITATION without additional evidence. ### 🧠 CyberSignal Insight AI gateways are becoming security control planes. They increasingly sit between applications, agents and multiple model providers — often with access to credentials and privileged upstream services. That means plugin-management security in an AI gateway deserves the same scrutiny we already give extension systems in browsers, CI/CD platforms and management servers. The AI stack is acquiring a plugin attack surface of its own. Sources: JFrog CNA · CVE · Maximhq Bifrost

CVE-2026-86242 Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authenticatio… https://www.cve.org/CVERecord?id=CVE-2026-86242

Açık Kaynaklı AI Ağ Geçidi Bifrost'taki Kritik Açık, Saldırganların Kimlik Doğrulaması Olmadan Sunucuda Komut Çalıştırmasına İzin Veriyor! 20'den fazla LLM sağlayıcısına istekleri yönlendiren açık kaynaklı Bifrost AI ağ geçidindeki CVE-2026-90898 (CVSS 9.8), varsayılan olarak devre dışı olan yönetim kimlik doğrulamasından yararlanarak, saldırganların "/api/mcp/client" uç noktasına kimlik doğrulamasız bir istek göndererek sunucuda anında komut çalıştırmasına izin veriyor. • Aynı yazılımda bulunan ikinci bir açık (CVE-2026-86242, CVSS 8.1), harici bir URL üzerinden özel eklenti kaydı yapılmasına ve dinamik kod yürütülmesine olanak tanıyor. • Resmi Docker imajının yönetim API'sini varsayılan olarak 0.0.0.0'a bağlaması, açığı internete açık kurulumlarda dışarıdan doğrudan istismar edilebilir hale getiriyor; başarılı bir saldırı, ağ geçidinde saklanan tüm AI sağlayıcı API anahtarlarını ifşa edebiliyor. Yapay zeka altyapısını yönetmek için kullanılan araçların "varsayılan olarak kimlik doğrulaması kapalı" gibi temel güvenlik hatalarıyla dağıtılabilmesi, hızla büyüyen AI araç ekosisteminin olgunluk düzeyinin henüz kurumsal güvenlik standartlarını yakalayamadığını gösteriyor. #SiberGüvenlik #YapayZeka #KritikAçık