Read the docs
TI-2026-61769 Aliases CVE-2026-90898GHSA-gqjq-cgxr-8c7c

Bifrost unauthenticated remote code execution via MCP stdio client registration

Priority MEDIUM 53CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).  transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02311 83rd percentileScored 2026-11-07
Fix Fixed Bifrost (maximhq): 2.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
maximhqBifrostbefore 2.1.02.1.0Patch availableCNA
  • Bifrost Vendormaximhq Affected before 2.1.0 Fixed in 2.1.0 Patch available CNA

Remediation

  • Fix · CNA Bifrost (maximhq) Fixed in 2.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-90898
  2. 2026-10-03 Alias added: GHSA-gqjq-cgxr-8c7c
  3. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Patch 2

Other 2

  • TI-2026-39919 Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL CVSS 4.0HIGH 8.7
  • TI-2026-59029 Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences