Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds
Summary
| CVE | CVE-2026-86242 |
|---|---|
| State | PUBLISHED |
| Assigner | JFROG |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-06 12:17:15 UTC |
| Updated | 2026-09-06 12:17:15 UTC |
| Description | Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go's plugin.Open. After a successful open, optional Init runs immediately with the supplied config as the Bifrost process user. On documented dynamically linked builds (DYNAMIC=1 / no static-link flags), which the vendor requires for custom Go plugins, plugin.Open is expected to succeed and this is unauthenticated remote code execution. On the published statically linked Docker image, plugin.Open fails with Dynamic loading not supported, so that build class is only server-side request forgery. Attack complexity is High because the attacker cannot force RCE on the default static image and a loadable plugin must match the host Go version, OS, architecture, and linkage. The 1.6.x HTTP transport line through 1.6.11 does not contain the fix. |
Risk And Classification
Primary CVSS: v3.1 8.1 HIGH from [email protected]
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.006180000 probability, percentile 0.474010000 (date 2026-09-07)
Problem Types: CWE-94 | CWE-284 | CWE-306 | CWE-94 CWE-94: Improper Control of Generation of Code ('Code Injection') | CWE-306 CWE-306: Missing Authentication for Critical Function | CWE-284 CWE-284: Improper Access Control
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 8.1 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 8.1 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/maximhq/bifrost/security/advisories/GHSA-2qp8-4xgm-fw6g | [email protected] | github.com | |
| github.com/maximhq/bifrost/pull/5763 | [email protected] | github.com | |
| github.com/maximhq/bifrost/releases/tag/transports/v2.0.0 | [email protected] | github.com | |
| github.com/maximhq/bifrost/commit/e0057ff355f831c251eabe9d0e44f3a3748532c6 | [email protected] | github.com | |
| github.com/maximhq/bifrost | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Or Peles (en)
CNA: JFrog Security Research (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-07-19T10:02:00.000Z | Reported to the Bifrost maintainers (GHSA-2qp8-4xgm-fw6g) |
| CNA | 2026-08-03T04:50:00.000Z | Fix merged upstream (PR #5763) |
| CNA | 2026-08-13T18:51:00.000Z | Fix first present on the v2 line in transports/v2.0.0-prerelease3 |
| CNA | 2026-08-26T19:47:00.000Z | Fix first shipped in a stable release (Bifrost HTTP v2.0.0) |
Solutions
CNA: Upgrade Bifrost HTTP transport to 2.0.0 or later. The fix (PR #5763) refuses create and update of a non-builtin plugin path when the request was let through because dashboard authentication is disabled or unconfigured (403), and replaces the plugin downloader with an SSRF-hardened client. The 1.6.x line through 1.6.11 does not include this change.
Workarounds
CNA: If custom Go plugins are not required, run the statically linked binary or official Docker image so plugin.Open cannot succeed. Otherwise enable dashboard authentication and keep the management listener off untrusted networks.
Exploits
CNA: A proof of concept issues an unauthenticated POST /api/plugins with enabled=true and path set to an HTTP URL of a Go shared object built for the target Go version and linkage. On a dynamically linked Bifrost binary the loader downloads the body and plugin.Open runs Init in-process (for example writing a marker file as the gateway user). On the official static image the same request downloads the file and then fails with Dynamic loading not supported.