Bifrost unauthenticated remote code execution via MCP stdio client registration
Summary
| CVE | CVE-2026-90898 |
|---|---|
| State | PUBLISHED |
| Assigner | JFROG |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-14 11:17:08 UTC |
| Updated | 2026-09-14 12:17:51 UTC |
| Description | Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image). transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it. |
Risk And Classification
Primary CVSS: v3.1 9.8 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-284 | CWE-306 | CWE-306 CWE-306 Missing Authentication for Critical Function | CWE-284 CWE-284 Improper Access Control
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/maximhq/bifrost/pull/6757 | [email protected] | github.com | |
| github.com/maximhq/bifrost/releases/tag/transports/v2.1.0 | [email protected] | github.com | |
| github.com/maximhq/bifrost | [email protected] | github.com | |
| github.com/maximhq/bifrost/commit/12e170352bd25eab1ae9ba16611f1797d1fd8fdc | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Yuval Moravchick | JFrog (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-07-13T10:27:00.000Z | Reported to the Bifrost maintainers (GHSA-86gf-xh3g-rvxq) |
| CNA | 2026-09-02T15:14:00.000Z | Fix merged upstream (PR #6757) |
| CNA | 2026-09-08T15:15:00.000Z | Fix first shipped in Bifrost HTTP v2.1.0 |
Solutions
CNA: Upgrade Bifrost HTTP transport to 2.1.0 or later. PR #6757 returns 403 for unauthenticated stdio MCP client registration when dashboard authentication is disabled or unconfigured. Authenticated admins can still add stdio clients. The 1.6.x line through 1.6.11 and transports/v2.0.0 do not include this change.
Workarounds
CNA: Set governance.auth_config.is_enabled to true, use strong administrator credentials, and firewall the management listener.
Exploits
CNA: JFrog has a private proof of concept. An unauthenticated POST /api/mcp/client with connection_type stdio and attacker-chosen command and args starts the program in the gateway. Public exploit details are not included in this record.