{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-90898", "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "state": "PUBLISHED", "assignerShortName": "JFROG", "dateReserved": "2026-09-14T10:13:28.161Z", "datePublished": "2026-09-14T10:18:53.454Z", "dateUpdated": "2026-09-14T11:19:46.276Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "shortName": "JFROG", "dateUpdated": "2026-09-14T10:18:53.454Z" }, "title": "Bifrost unauthenticated remote code execution via MCP stdio client registration", "problemTypes": [ { "descriptions": [ { "lang": "en", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "type": "CWE" } ] }, { "descriptions": [ { "lang": "en", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "type": "CWE" } ] } ], "affected": [ { "vendor": "maximhq", "product": "Bifrost", "platforms": [ "Linux", "macOS" ], "collectionURL": "https://github.com/maximhq/bifrost", "packageName": "github.com/maximhq/bifrost/transports", "repo": "git://github.com/maximhq/bifrost", "modules": [ "transports/bifrost-http", "core/mcp" ], "programFiles": [ "transports/bifrost-http/handlers/mcp.go", "transports/bifrost-http/handlers/middlewares.go" ], "versions": [ { "status": "affected", "version": "0", "lessThan": "2.1.0", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "descriptions": [ { "lang": "en", "value": "Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.\n\n\n\nThe default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).\n\n\n\n transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.

The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).

 transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.

" } ] } ], "references": [ { "url": "https://github.com/maximhq/bifrost/pull/6757", "name": "PR #6757: refuse unauthenticated stdio MCP registration", "tags": [ "patch" ] }, { "url": "https://github.com/maximhq/bifrost/commit/12e170352bd25eab1ae9ba16611f1797d1fd8fdc", "name": "Merge commit for PR #6757", "tags": [ "patch" ] }, { "url": "https://github.com/maximhq/bifrost/releases/tag/transports/v2.1.0", "name": "Bifrost HTTP v2.1.0 (first release containing the fix)", "tags": [ "release-notes" ] }, { "url": "https://github.com/maximhq/bifrost", "name": "Bifrost repository", "tags": [ "product" ] } ], "metrics": [ { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV3_1": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } } ], "configurations": [ { "lang": "en", "value": "Management API reachable and governance.auth_config.is_enabled=false, which is the documented default. Confirmed on maximhq/bifrost v1.6.3. Fixed in transports/v2.1.0 (2026-09-08). An operator who enables management authentication and keeps the admin listener off untrusted networks is not exposed to the unauthenticated form of this issue.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

Management API reachable and governance.auth_config.is_enabled=false, which is the documented default. Confirmed on maximhq/bifrost v1.6.3. Fixed in transports/v2.1.0 (2026-09-08). An operator who enables management authentication and keeps the admin listener off untrusted networks is not exposed to the unauthenticated form of this issue.

" } ] } ], "workarounds": [ { "lang": "en", "value": "Set governance.auth_config.is_enabled to true, use strong administrator credentials, and firewall the management listener.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

Set governance.auth_config.is_enabled to true, use strong administrator credentials, and firewall the management listener. 

" } ] } ], "solutions": [ { "lang": "en", "value": "Upgrade Bifrost HTTP transport to 2.1.0 or later. PR #6757 returns 403 for unauthenticated stdio MCP client registration when dashboard authentication is disabled or unconfigured. Authenticated admins can still add stdio clients. The 1.6.x line through 1.6.11 and transports/v2.0.0 do not include this change.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

Upgrade Bifrost HTTP transport to 2.1.0 or later. PR #6757 returns 403 for unauthenticated stdio MCP client registration when dashboard authentication is disabled or unconfigured. Authenticated admins can still add stdio clients. The 1.6.x line through 1.6.11 and transports/v2.0.0 do not include this change.

" } ] } ], "exploits": [ { "lang": "en", "value": "JFrog has a private proof of concept. An unauthenticated POST /api/mcp/client with connection_type stdio and attacker-chosen command and args starts the program in the gateway. Public exploit details are not included in this record.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

JFrog has a private proof of concept. An unauthenticated POST /api/mcp/client with connection_type stdio and attacker-chosen command and args starts the program in the gateway. Public exploit details are not included in this record.

" } ] } ], "timeline": [ { "time": "2026-07-13T10:27:00.000Z", "lang": "en", "value": "Reported to the Bifrost maintainers (GHSA-86gf-xh3g-rvxq)" }, { "time": "2026-09-02T15:14:00.000Z", "lang": "en", "value": "Fix merged upstream (PR #6757)" }, { "time": "2026-09-08T15:15:00.000Z", "lang": "en", "value": "Fix first shipped in Bifrost HTTP v2.1.0" } ], "credits": [ { "lang": "en", "value": "Yuval Moravchick | JFrog", "type": "finder" } ], "source": { "discovery": "EXTERNAL" }, "x_generator": { "engine": "Vulnogram 1.0.4" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2026-90898", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2026-09-14T11:01:44.207374Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-14T11:19:46.276Z" } } ] } }