CVE-2026-90898
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.
The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).
transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| maximhq | Bifrost | 0 < 2.1.0 | affected |
Weaknesses
- CWE-306: CWE-306 Missing Authentication for Critical Function
- CWE-284: CWE-284 Improper Access Control
Workarounds
Set governance.auth_config.is_enabled to true, use strong administrator credentials, and firewall the management listener.
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: yes
- Technical Impact: total
References
- https://github.com/maximhq/bifrost/pull/6757
- https://github.com/maximhq/bifrost/commit/12e170352bd25eab1ae9ba16611f1797d1fd8fdc
- https://github.com/maximhq/bifrost/releases/tag/transports/v2.1.0
- https://github.com/maximhq/bifrost
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.