CVE-2026-86242
Received Received - Intake

Bifrost HTTP Transport Plugin Path Remote Code Execution

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: JFrog

Description
Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go's plugin.Open. After a successful open, optional Init runs immediately with the supplied config as the Bifrost process user. On documented dynamically linked builds (DYNAMIC=1 / no static-link flags), which the vendor requires for custom Go plugins, plugin.Open is expected to succeed and this is unauthenticated remote code execution. On the published statically linked Docker image, plugin.Open fails with Dynamic loading not supported, so that build class is only server-side request forgery. Attack complexity is High because the attacker cannot force RCE on the default static image and a loadable plugin must match the host Go version, OS, architecture, and linkage. The 1.6.x HTTP transport line through 1.6.11 does not contain the fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-86242
EUVD
EUVD-2026-72104

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
maximhq bifrost to 2.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows unauthenticated remote code execution in Bifrost HTTP transport before version 2.0.0. When management authentication is disabled, an attacker can send a POST request to /api/plugins with a custom plugin path set to an HTTP URL. The system downloads the file at that URL, treats it as a shared object (.so), and loads it into the Bifrost process. On dynamically linked builds, this results in remote code execution. On statically linked builds, it only allows server-side request forgery due to plugin loading failure.

Detection Guidance

Check Bifrost HTTP transport versions before 2.0.0 for unauthenticated POST requests to /api/plugins with custom plugin paths. Monitor for unexpected .so file downloads or plugin loads. Review logs for 403 errors when attempting to set non-builtin plugin paths with authentication disabled.

Impact Analysis

If you run Bifrost HTTP transport before 2.0.0 with default settings, an attacker could exploit this to execute arbitrary code on your server. This could lead to full system compromise, data theft, or service disruption. The impact depends on your deployment: dynamically linked builds are at higher risk than statically linked ones.

Compliance Impact

This vulnerability enables unauthenticated remote code execution (RCE) by allowing attackers to inject arbitrary native code into the Bifrost gateway process through custom plugin paths. This could lead to unauthorized access to sensitive data, data exfiltration, or system compromise, which directly violates compliance requirements under GDPR (data protection) and HIPAA (protected health information).

Mitigation Strategies

Upgrade Bifrost HTTP transport to version 2.0.0 or later. Enable dashboard authentication if currently disabled. Block unauthenticated POST requests to /api/plugins. Restrict plugin path modifications to authenticated admin sessions only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86242. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart