CVE

CVE-2026-90898

9.8

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image). transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

bifrost

Updated Nov 10, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

Bifrost < 2.1.0 - Unauthenticated MCP Stdio Command Execution

When dashboard authentication is disabled, Bifrost accepts an unauthenticated stdio MCP client registration and starts its configured command before the MCP handshake completes. This template runs a benign outbound HTTP request from the target and requires an out-of-band callback to confirm command execution. References: https://github.com/maximhq/bifrost/pull/6757 Remediation: Upgrade Bifrost to transports v2.1.0 or later and enable dashboard authentication.

10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: bifrost

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →