CVE-2026-90898— Bifrost unauthenticated remote code execution via MCP stdio client registration
Quick assessment
Affected
maximhq Bifrost
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Bifrost 通过其管理 API 注册 MCP 客户端。stdio 类型的客户端由命令和参数组成。当客户端被添加时，Bifrost 会在网关中立即启动该程序，无需进行 MCP 握手。 默认情况下， 被设置为 。认证关闭意味着每个调用者都被视为本地管理员。因此，只需一次未认证的 请求，就可以以 Bifrost 进程用户（在官方镜像中为 ）的身份运行一个程序。 会以 403 状态码拒绝未认证的 stdio 注册，而 仍允许该操作。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90898
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Bifrost unauthenticated remote code execution via MCP stdio client registration
Source: CVE Program / CVE List V5
Vulnerability Description
Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.
The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).
transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-90898
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90898
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-90898 (1)
Proof of Concept for CVE-2026-90898 (1)
Vendor Pages for CVE-2026-90898 (1)
IV. Related Vulnerabilities
Same product: Bifrost
-
CVE-2026-86840
Bifrost Unauthorized Channel Commission Attribution Allows C -
CVE-2026-86242
Unauthenticated RCE via Custom Plugin HTTP Path on Dynamical -
CVE-2026-55245
Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT -
CVE-2022-39267
Brokercap Bifrost vulnerable to authentication bypass for ad -
CVE-2022-39219
Bifrost users using basic authntication can bypass write per
Same weakness: CWE-306
-
CVE-2026-90938
LangBot through 0.4.17 Unauthenticated Plugin Registration v -
CVE-2026-82787
CPSL-08P1EN 关键函数缺失认证 -
CVE-2026-82784
CPSN-MCB271未认证REST API导致I/O被控 -
CVE-2026-90620
0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py -
CVE-2026-90579
cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _auth
V. Comments for CVE-2026-90898
No comments yet