Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials
A critical vulnerability (CVE-2026-90898) in Bifrost, an open-source AI gateway, allows unauthenticated attackers to execute arbitrary commands on the gateway server. This flaw stems from a default configuration that ships with authentication disabled, and a second related vulnerability allows attackers to register custom plugins, potentially exposing API keys. The vulnerability has a CVSS score of 9.8 and follows a pattern seen in other AI gateways, leading to potential real-world attacks.
A critical vulnerability (CVE-2026-90898) exists in Bifrost, an open-source AI gateway that routes requests to over 20 Large Language Model (LLM) providers. The flaw allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request. This vulnerability is due to the default configuration of Bifrost, which ships with authentication disabled. A second, related vulnerability (CVE-2026-86242) allows an unauthenticated attacker to register a custom plugin whose path is an HTTP URL. Bifrost downloads the file, writes it as a temporary shared object, and loads it through Go's plugin.Open function.
On dynamically linked builds, which Bifrost requires for custom Go plugins, the plugin loads and its code runs as the gateway process user. On statically linked builds, including the official Docker image, plugin.Open fails and the result is server-side request forgery only. The fix for both vulnerabilities is available in transports/v2.1.0.
Operators should upgrade to transports/v2.1.0 immediately. If upgrading is not possible, they should set governance.auth_config.is_enabled to true, use strong credentials, and keep the management listener off untrusted networks. JFrog advises treating any instance that ran with authentication disabled and the management API exposed as compromised, and rotating virtual keys and provider API keys.
The vulnerability follows a pattern seen in other AI gateways, including Anthropic's official SDKs (April 2026) and LiteLLM, which was actively exploited and added to CISA's Known Exploited Vulnerabilities catalog in June. Both flaws stem from the same root cause: Bifrost's management API ships with authentication disabled by default. The vulnerability is the second and third security issues disclosed in the project in under a month, after an unrelated SSRF flaw (CVE-2026-55245) fixed in late August.