Bifrost AI Gateway Flaw Exposes Servers to Unauthenticated Attacks

A high-severity vulnerability in Bifrost, a popular open-source tool for routing AI model requests, has been disclosed. The flaw allows an attacker to execute arbitrary commands on the server without any authentication. This means anyone with network access to the management interface can take control of the system.

The issue, identified as CVE-2026-90898, carries a maximum CVSS score of 9.8. It affects all versions prior to 2.1.0 where management authentication is disabled, which is the default setting. According to The Hacker News, the vulnerability enables attackers to register a specific client type that triggers immediate command execution as the gateway user.

Default Settings Create Exposure

The core problem lies in the default configuration of the Bifrost HTTP transport. When authentication is turned off, the management API endpoint becomes accessible to unauthenticated users. An attacker can send a single HTTP request to register a standard input-output client. This action causes the gateway to start the specified command immediately, bypassing any security handshake.

While the standard binary restricts this access to the local machine, the official Docker image binds the interface to all network interfaces. If the port is published, the management API is reachable from outside the container. This configuration choice significantly expands the attack surface for organizations deploying Bifrost in containerized environments.

Credential Theft and Remediation

Executing commands on the gateway process grants access to stored API keys for all connected language model providers. This allows attackers to steal sensitive credentials and potentially abuse paid services. Researchers advise treating any instance running with authentication disabled as compromised. Operators must rotate virtual keys and provider API keys to mitigate the risk.

The fix is available in version 2.1.0 of the transport module. This update ensures that the system returns a forbidden error when an unauthenticated caller attempts to register the problematic client type. Users who cannot upgrade immediately should enable governance authentication, use strong credentials, and ensure the management listener is not exposed to untrusted networks.

Pattern of Security Issues

This vulnerability is part of a broader pattern of security issues in the project. A second flaw, CVE-2026-86242, allows attackers to register custom plugins that load malicious code. Both issues stem from the same root cause: the management API ships with authentication disabled by default. These are the third security disclosures in under a month for the software.

Similar flaws in other AI gateways have already been exploited in the wild. A comparable command-injection vulnerability in LiteLLM was actively exploited and added to the CISA Known Exploited Vulnerabilities catalog. While the Bifrost flaws are not yet listed in that catalog, the risk of exploitation is considered high due to the ease of access.