CVE-2026-90898
Received Received - Intake

Unauthenticated Stdio Client Registration in Bifrost

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: JFrog

Description
Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).  transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90898
EUVD
EUVD-2026-77357

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
maximhq bifrost v2.1.0
maximhq bifrost v2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows unauthenticated users to register a stdio MCP client in Bifrost's management API. Bifrost then executes the registered command as the gateway process user without requiring an MCP handshake. With authentication disabled by default, a single unauthenticated POST request to /api/mcp/client can lead to arbitrary command execution as the Bifrost process user.

Detection Guidance

Check if Bifrost is running with authentication disabled by inspecting the configuration for governance.auth_config.is_enabled=false. Verify if unauthenticated POST requests to /api/mcp/client are accepted, which would indicate the vulnerability exists. Check logs for unexpected subprocess executions or connections to loopback/private addresses.

Impact Analysis

An attacker could exploit this to run arbitrary commands on the system running Bifrost, potentially gaining full control over the server. This could lead to data theft, system compromise, or further network infiltration. The vulnerability also allows unauthenticated registration of HTTP or SSE clients targeting internal services, enabling SSRF attacks against private network resources.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using Bifrost may face compliance violations, legal penalties, and reputational damage due to potential exposure of sensitive data.

Mitigation Strategies

Upgrade to Bifrost transports/v2.1.0 or later to enforce authentication checks. Ensure governance.auth_config.is_enabled=true to require authentication. Block unauthenticated POST /api/mcp/client requests at the network level. Review and restrict MCP client registrations to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90898. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart