CVE-2026-90898

CRITICAL 9.8

Bifrost unauthenticated remote code execution via MCP stdio client registration

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image). transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.

CWE	CWE-306 CWE-284
Vendor	maximhq
Product	bifrost
Published	Sep 14, 2026
Last Updated	Sep 14, 2026

Stay Ahead of the Next One

Get instant alerts for maximhq bifrost

Be the first to know when new critical vulnerabilities affecting maximhq bifrost are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

maximhq / Bifrost

0 < 2.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/maximhq/bifrost/pull/6757 github.com: https://github.com/maximhq/bifrost/commit/12e170352bd25eab1ae9ba16611f1797d1fd8fdc github.com: https://github.com/maximhq/bifrost/releases/tag/transports/v2.1.0 github.com: https://github.com/maximhq/bifrost

Credits

Yuval Moravchick | JFrog