CVE-2026-90898Patch

MEDIUMCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 9 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image). transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.

Back to dashboard

5.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-284CWE-306

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 2 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
25 mentions across 7 observed days

What's happening

Active exploitation reported across 2 signals
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 17 signals
Technical details provided in 25 signals
Disclosure: 7 classified signals
Peaked 3d ago at 9 mentions (2026-09-23); latest day: 1
25 total mentions across 7 days

Deep dive

Activity timeline25 mentions / 7d

Signal classification4 categories

Patch

1560.0%

Disclosure

728.0%

Active Exploitation

28.0%

PoC

14.0%

Referenced assets11 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-14	1	Patch1
2026-09-15	2	Disclosure1Patch1
2026-09-22	4	Disclosure1Patch3
2026-09-23	9	Active Exploitation1Disclosure2Patch6
2026-09-24	7	Active Exploitation1Disclosure2Patch4
2026-10-02	1	PoC1
2026-10-13	1	Disclosure1

Full discourse20 posts

The Hacker News@TheHackersNews38d
Patch
🚨 A single unauthenticated POST can make Bifrost run attacker-supplied commands with management auth disabled, the default setting. CVE-2026-90898 affects versions before 2.1.0, and command execution can expose stored LLM provider API keys. Read: https://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.html
Post summary
The post discloses a critical unauthenticated RCE in Bifrost AI Gateway (CVE-2026-90898) caused by default disabled management auth, explicitly noting that versions before 2.1.0 are affected, thereby highlighting the availability of a patched version.
98241822.3K
2.4M followersView on X
JFrog Security@JFrogSecurity38d
Disclosure
Auth is off by default. One unauthenticated POST -> shell. 🚨 Two unauthenticated RCEs in the Bifrost AI Gateway, found by JFrog Research 🚨 Technical details >> https://research.jfrog.com/vulnerabilities/bifrost-is-vulnerable-to-unauthenticated-remote-code-execution-via-mcp-stdio-client-registration-cve-2026-90898/ https://research.jfrog.com/vulnerabilities/bifrost-is-vulnerable-to-unauthenticated-remote-code-execution-via-a-custom-plugin-http-path-on-dynamically-linked-builds-cve-2026-86242-jfsa-2026-001684572/ https://t.co/Wes8gZsURN
Post summary
The tweet discloses two unauthenticated remote code execution vulnerabilities in the Bifrost AI Gateway, providing technical details but no exploit code, patches, or evidence of active exploitation.
340561.1K
5.6K followersView on X
!Manan@0xManan28d
PoC
AI gateway MCP API. Auth defaults OFF. One POST = your command runs. CVE-2026-90898 (CVSS 9.8) - Bifrost. Chain: `governance.auth_config.is_enabled=false` → unauth `POST /api/mcp/client` with `connection_type: stdio` → attacker command/args start as the Bifrost process user. No MCP handshake. No creds. Fixed in transports/v2.1.0 (403 on unauth stdio). Tip (JFrog PoC): https://research.jfrog.com/vulnerabilities/bifrost-is-vulnerable-to-unauthenticated-remote-code-execution-via-mcp-stdio-client-registration-cve-2026-90898/ If you expose AI gateways, RT this to your team. #InfoSec #MCP #CVE #RCE
Post summary
The tweet discloses CVE-2026-90898, an unauthenticated RCE in the Bifrost AI gateway caused by default authentication being disabled, shares a link to a JFrog Proof-of-Concept, and notes the fix in version 2.1.0.
20051526
2.3K followersView on X
Rıdvan Yağlı@ridvanyagli46d
Patch
🚨 Bifrost'ta CVE-2026-90898 olarak takip edilen kritik güvenlik açığı, kimlik doğrulaması olmadan uzaktan kod çalıştırılmasına neden oluyor. Açık, MCP stdio client kayıt mekanizmasında bulunuyor. Saldırganın yalnızca /api/mcp/client API'sine gönderdiği tek bir POST isteğiyle Bifrost gateway üzerinde bir program çalıştırması mümkün. 🔴 CVSS: 9.8 Critical 🔓 Kimlik doğrulaması gerektirmiyor 🌐 Uzaktan istismar edilebilir 💥 RCE 📌 Etkilenen: Bifrost < 2.1.0 ✅ Çözüm: Bifrost 2.1.0 ve üstü JFrog tarafından bildirilen açıkta, authentication'ın varsayılan olarak kapalı olması saldırı yüzeyini daha da artırıyor. https://github.com/maximhq/bifrost/releases/tag/transports/v2.1.0
Post summary
The post discloses CVE-2026-90898 as a critical (CVSS 9.8) authentication-bypass RCE vulnerability in Bifrost affecting versions prior to 2.1.0, and directs users to upgrade to Bifrost 2.1.0 as the remediation.
11051586
2.5K followersView on X
Yev Mura@YevMur37d
Disclosure
JFrog disclosed CVE-2026-90898 in Bifrost, an open-source AI gateway for 20+ LLM providers. One unauthenticated POST to /api/mcp/client registers a stdio MCP client and runs attacker commands as the gateway user. Default: management auth off. CVSS 9.8. @JFrog @TheHackersNews https://t.co/K9t905kFGu
Post summary
JFrog disclosed CVE-2026-90898 in the Bifrost AI gateway—an unauthenticated RCE via MCP client registration with CVSS 9.8. The text announces the vulnerability with technical details but mentions no PoC, exploit tool, active exploitation, or patch.
11030321
38 followersView on X
pdnuclei-bot@pdnuclei_bot18d
Disclosure
🚨 CVE-2026-90898 - critical 🚨 Bifrost < 2.1.0 - Unauthenticated MCP Stdio Command Execution > When dashboard authentication is disabled, Bifrost accepts an unauthenticated stdio M... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-90898 @pdnuclei #NucleiTemplates #cve
Post summary
The post announces CVE-2026-90898 and provides a brief technical description of unauthenticated command execution in affected Bifrost versions. It does not mention a PoC, active exploitation, or a remediation.
00022272
1.4K followersView on X
Sudheer@sudheerdotai38d
Patch
Bifrost AI gateway (20+ LLM providers): one unauthenticated POST to /api/mcp/client registers a stdio MCP client and executes it as the gateway user — before any handshake. Auth off by default. Official Docker binds 0.0.0.0. CVE-2026-90898, CVSS 9.8. Patch transports/v2.1.0 or assume every provider key is burned.
Post summary
CVE‑2026‑90898 in Bifrost AI gateway allows unauthenticated RCE via a POST to /api/mcp/client, and the vendor provides a patch version transports/v2.1.0 (or advises burning provider keys).
1101069
262 followersView on X
Jonatas ➔ 🐕 caramelosec.com@kyoto01z38d
Disclosure
Um POST sem senha, e o seu gateway de IA roda o comando que o atacante mandar. E ele guarda as chaves de todos os seus provedores de LLM. É o CVE-2026-90898, no Bifrost, um gateway open-source que roteia pra mais de 20 LLMs. A autenticação do management vinha desligada por padrão. O ataque é um POST em /api/mcp/client que registra um cliente MCP stdio. O gateway inicia esse cliente rodando um comando, na hora. Aí vem o prêmio. Esse processo guarda a chave de API de cada provedor conectado, então quem roda comando ali sai com todas na mão. A lição é velha em contexto novo: recurso que roda comando mais porta sem senha vira RCE. Veja o que na sua stack de IA está exposto assim. Vê como está a segurança da sua aplicação num scan rápido: http://caramelosec.com 🐕 #bolhasec #bolhadev
Post summary
The post discloses CVE-2026-90898 in the open-source Bifrost AI gateway, where disabled management authentication allows an unauthenticated POST to execute arbitrary commands and steal all connected LLM API keys, illustrating a classic command‑injection risk via an exposed interface.
01011136
173 followersView on X
CyberSignal | Cybersecurity & AI News@XQOPTRX37d
Patch
🚨 CRITICAL AI INFRASTRUCTURE FLAW — ONE HTTP REQUEST CAN BECOME COMMAND EXECUTION A critical vulnerability affects Bifrost, an open-source AI gateway connecting applications to more than 20 LLM providers. CVE-2026-90898 CVSS: 9.8 The issue involves Bifrost's MCP client registration. With management authentication disabled — historically the default — an attacker can register a malicious stdio MCP client. One request ↓ Attacker supplies command ↓ Bifrost launches it ↓ Code executes as gateway user And the gateway may hold API credentials for: 🤖 OpenAI 🤖 Anthropic 🤖 Gemini 🤖 other connected model providers That means RCE can potentially become credential theft across multiple AI providers. Fixed in Bifrost transport 2.1.0. CyberSignal insight: AI gateways are becoming concentrated trust hubs. The more models they connect, the more valuable one compromised gateway becomes. Source: JFrog Security Research #AISecurity #MCP #Cybersecurity
Post summary
The text announces a critical RCE vulnerability (CVE-2026-90898, CVSS 9.8) in the Bifrost AI gateway involving its MCP client registration, with a named fix in transport version 2.1.0. While detailed exploitation and technical specifics are provided, the central actionable takeaway is the availability of a patch.
0101082
236 followersView on X
Isao Takaesu@bbr_bbq37d
Patch
OSSのAI Gateway「Bifrost」に、認証なしのPOSTリクエストで任意コマンドを実行できる脆弱性が見つかったとのこと（CVE-2026-90898, CVSS 9.8）。管理APIの認証がデフォルト無効であることが原因。transports/v2.1.0で修正済み。 https://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.html
Post summary
The tweet discloses a critical RCE flaw (CVE‑2026‑90898, CVSS 9.8) in Bifrost AI Gateway that allows unauthenticated command execution, and notes it has been patched in transports/v2.1.0; no PoC, exploit tool, or active exploitation evidence is provided.
00010407
2.5K followersView on X
Sudheer@sudheerdotai38d
Patch
Bifrost AI gateway (20+ LLM providers): one unauthenticated POST to /api/mcp/client registers a stdio MCP client and executes it as the gateway user — before any handshake. Auth off by default. Official Docker binds 0.0.0.0. CVE-2026-90898, CVSS 9.8. Patch transports/v2.1.0 or assume every provider key is burned.
Post summary
The text reports CVE-2026-90898 in Bifrost AI gateway with unauthenticated pre-handshake execution and a CVSS 9.8 score, and advises patching to transports/v2.1.0.
1000050
262 followersView on X
SOCMinute@SOCMinute38d
Patch
A critical vulnerability (CVE-2026-90898) in Bifrost AI Gateway lets attackers execute commands without credentials. Update to version 2.1.0 immediately and audit logs for suspicious activity. #Bifrost #AIsecurity #SOCMinute https://t.co/vEzF7hGWcJ
Post summary
The tweet discloses CVE-2026-90898 in Bifrost AI Gateway (unauthenticated command execution) and prioritizes patching by urging an immediate update to v2.1.0 plus log auditing.
0001044
16 followersView on X
Anthony Bahn@HoustonIntrove138d
Patch
I'd yank Bifrost from the internet until 2.1.0+. CVE-2026-90898 is one unauth POST with management auth off by default. Your LLM provider keys are the prize.
Post summary
The text identifies CVE-2026-90898 as an unauthenticated POST vulnerability in Bifrost when management auth is disabled, recommending removal until version 2.1.0+ is deployed. It confirms technical details and a named workaround while pointing to a forthcoming patch.
1000072
38 followersView on X
Ryan Merck@rmerck45d
Patch
Bifrost ships dashboard auth off. Unauthenticated POST /api/mcp/client with a stdio command starts that process as the gateway user. People treat this as a connector feature. 2.1.0 403s it. Leave 2.0.0's listener reachable and the CVE is the listener. https://nvd.nist.gov/vuln/detail/CVE-2026-90898
Post summary
The post discloses an authentication bypass in Bifrost 2.0.0 via an unauthenticated POST to /api/mcp/client and notes that upgrading to version 2.1.0 mitigates the issue by returning a 403 response.
1000056
46 followersView on X
Juan F Gallego@jfernandogg36d
Active Exploitation
Si Bifrost pre-2.1.0 escuchó en 0.0.0.0 con auth off, el RCE CVE-2026-90898 no es teórico. Rota todas las API keys que vivían en ese gateway, revisa logs de /api/mcp/client y deja el plano de management solo en red privada. Upgrade sin rotación = parche cosmético.
Post summary
The text confirms CVE-2026-90898 (RCE in Si Bifrost pre-2.1.0) is actively exploited when misconfigured and urges immediate rotation of API keys and a non-cosmetic upgrade.
0000060
342 followersView on X
Juan F Gallego@jfernandogg36d
Disclosure
Un “gateway” de IA es la puerta por donde pasan las llaves de ChatGPT, Claude y compañía. En Bifrost encontró un fallo crítico (CVE-2026-90898, nota 9.8): sin usuario ni contraseña podías mandar un comando al servidor. Si tu empresa usa algo así expuesto a internet: apágalo hasta parchear, enciende autenticación y cambia todas las API keys. No es “un bug de geek”; es la caja fuerte sin candado.
Post summary
The tweet discloses CVE-2026-90898 with a CVSS 9.8 severity, describing unauthenticated command execution on AI gateways, and recommends general mitigations without naming a specific patch, exploit, or evidence of active exploitation.
0000061
342 followersView on X
Juan F Gallego@jfernandogg36d
Patch
CVE-2026-90898 (9.8): POST sin credenciales a /api/mcp/client registra un cliente MCP stdio y ejecuta comando. Bifrost guarda keys de +20 LLMs; auth off por defecto; imagen Docker en 0.0.0.0. Parche: transports/v2.1.0. Upgrade ya, auth ON, plano de management fuera de internet. Si estuvo expuesto: asume compromiso y rota keys.
Post summary
The tweet discloses CVE‑2026‑90898 (CVSS 9.8), describing a credential‑less POST to /api/mcp/client that can register an MCP client and execute commands, and provides the patch transports/v2.1.0 with mitigation steps.
0000045
342 followersView on X
BT Haberler@BTHaberler36d
Disclosure
Açık Kaynaklı AI Ağ Geçidi Bifrost'taki Kritik Açık, Saldırganların Kimlik Doğrulaması Olmadan Sunucuda Komut Çalıştırmasına İzin Veriyor! 20'den fazla LLM sağlayıcısına istekleri yönlendiren açık kaynaklı Bifrost AI ağ geçidindeki CVE-2026-90898 (CVSS 9.8), varsayılan olarak devre dışı olan yönetim kimlik doğrulamasından yararlanarak, saldırganların "/api/mcp/client" uç noktasına kimlik doğrulamasız bir istek göndererek sunucuda anında komut çalıştırmasına izin veriyor. • Aynı yazılımda bulunan ikinci bir açık (CVE-2026-86242, CVSS 8.1), harici bir URL üzerinden özel eklenti kaydı yapılmasına ve dinamik kod yürütülmesine olanak tanıyor. • Resmi Docker imajının yönetim API'sini varsayılan olarak 0.0.0.0'a bağlaması, açığı internete açık kurulumlarda dışarıdan doğrudan istismar edilebilir hale getiriyor; başarılı bir saldırı, ağ geçidinde saklanan tüm AI sağlayıcı API anahtarlarını ifşa edebiliyor. Yapay zeka altyapısını yönetmek için kullanılan araçların "varsayılan olarak kimlik doğrulaması kapalı" gibi temel güvenlik hatalarıyla dağıtılabilmesi, hızla büyüyen AI araç ekosisteminin olgunluk düzeyinin henüz kurumsal güvenlik standartlarını yakalayamadığını gösteriyor. #SiberGüvenlik #YapayZeka #KritikAçık
Post summary
The text discloses critical vulnerabilities in Bifrost AI gateway with detailed technical information, including unauthenticated command execution and a secondary code execution issue. It does not provide a PoC, named exploit tool, active exploitation report, or remediation details.
0000061
43 followersView on X
Victor@VMG_CU36d
Patch
Bifrost CVE-2026-90898: management auth off by default. One unauth POST registers an MCP stdio client and the gateway executes it before any handshake — as the user holding every LLM API key. Patch transports/v2.1.0. https://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.html
Post summary
The text discloses CVE-2026-90898 with technical details (auth bypass via unauth POST in Bifrost gateway) and explicitly names the patched version (transports/v2.1.0), making Patch the primary classification.
0000076
15 followersView on X
Bryan@so_sthbryan37d
Patch
Unauthenticated RCE in an open-source AI gateway. CVE-2026-90898 (CVSS 9.8) in Bifrost routes requests to 20+ LLM providers. One HTTP request runs arbitrary commands. Affects versions before 2.1.0. https://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.html
Post summary
The tweet discloses CVE-2026-90898, an Unauthenticated RCE in Bifrost with a CVSS score of 9.8, and identifies 2.1.0 as the fixed version boundary. It provides technical details on the vulnerability and attack vector but contains no evidence of PoC availability, named exploit tools, or active in-the-wild exploitation.
0000060
282 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-90898

JFrog Security[verified]@JFrogSecurityDisclosure

The tweet discloses two unauthenticated remote code execution vulnerabilities in the Bifrost AI Gateway, providing technical details but no exploit code, patches, or evidence of active exploitation.

!Manan[verified]@0xMananPoC

The tweet discloses CVE-2026-90898, an unauthenticated RCE in the Bifrost AI gateway caused by default authentication being disabled, shares a link to a JFrog Proof-of-Concept, and notes the fix in version 2.1.0.

Rıdvan Yağlı[verified]@ridvanyagliPatch

The post discloses CVE-2026-90898 as a critical (CVSS 9.8) authentication-bypass RCE vulnerability in Bifrost affecting versions prior to 2.1.0, and directs users to upgrade to Bifrost 2.1.0 as the remediation.

Yev Mura[verified]@YevMurDisclosure

JFrog disclosed CVE-2026-90898 in the Bifrost AI gateway—an unauthenticated RCE via MCP client registration with CVSS 9.8. The text announces the vulnerability with technical details but mentions no PoC, exploit tool, active exploitation, or patch.

Sudheer[verified]@sudheerdotaiPatch

CVE‑2026‑90898 in Bifrost AI gateway allows unauthenticated RCE via a POST to /api/mcp/client, and the vendor provides a patch version transports/v2.1.0 (or advises burning provider keys).

Jonatas ➔ 🐕 caramelosec.com[verified]@kyoto01zDisclosure

The post discloses CVE-2026-90898 in the open-source Bifrost AI gateway, where disabled management authentication allows an unauthenticated POST to execute arbitrary commands and steal all connected LLM API keys, illustrating a classic command‑injection risk via an exposed interface.

CyberSignal | Cybersecurity & AI News[verified]@XQOPTRXPatch

The text announces a critical RCE vulnerability (CVE-2026-90898, CVSS 9.8) in the Bifrost AI gateway involving its MCP client registration, with a named fix in transport version 2.1.0. While detailed exploitation and technical specifics are provided, the central actionable takeaway is the availability of a patch.

Sudheer[verified]@sudheerdotaiPatch

The text reports CVE-2026-90898 in Bifrost AI gateway with unauthenticated pre-handshake execution and a CVSS 9.8 score, and advises patching to transports/v2.1.0.