Read the docs
TI-2022-18598 Aliases CVE-2022-39219GHSA-p6fh-xc6r-g5hw

Bifrost users using basic authntication can bypass write permission limit

Priority HIGH 70CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only have read permissions to write requests when they are normally forbidden from doing so. Version 1.8.7-release contains a patch. There are currently no known workarounds.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01176 67th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Bifrost (brokercap): 1.8.7-releasegithub.com/brokercap/Bifrost (Go): 1.8.7-release

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
brokercapBifrostbefore 1.8.7-release1.8.7-releasePatch availableCNA
—github.com/brokercap/Bifrost (Go)before 1.8.7-release1.8.7-releasePatch availableGHSA-p6fh-xc6r-g5hw
  • Bifrost Vendorbrokercap Affected before 1.8.7-release Fixed in 1.8.7-release Patch available CNA
  • github.com/brokercap/Bifrost (Go) Vendor— Affected before 1.8.7-release Fixed in 1.8.7-release Patch available GHSA-p6fh-xc6r-g5hw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:xbifrost:bifrost:*:*:*:*:*:*:*:*before 1.8.7VulnerableXbifrost
  • cpe:2.3:a:xbifrost:bifrost:*:*:*:*:*:*:*:* Versions before 1.8.7 Vulnerable ·Xbifrost

Remediation

  • Fix · CNA Bifrost (brokercap) Fixed in 1.8.7-release
  • Fix · GHSA-p6fh-xc6r-g5hw github.com/brokercap/Bifrost (Go) Fixed in 1.8.7-release Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39219
  2. 2026-10-03 Alias added: GHSA-p6fh-xc6r-g5hw

References

Exploit 1

Advisory 3

Other 1

  • TI-2022-18643 Brokercap Bifrost vulnerable to authentication bypass for admin and monitor user groups CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences