Full Report
A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request. The flaw, tracked as CVE-2026-90898 (CVSS score: 9.8), affects all versions of the Bifrost HTTP transport before 2.1.0 when management authentication is
Analysis Summary
# Vulnerability: Unauthenticated Remote Code Execution in Bifrost AI Gateway
## CVE Details
- **CVE ID:** CVE-2026-90898
- **CVSS Score:** 9.8 (Critical)
- **CWE:** Not explicitly mentioned (likely CWE-77: Command Injection or CWE-94: Code Injection)
## Affected Systems
- **Products:** Bifrost (Open-source AI gateway)
- **Versions:** All versions of Bifrost HTTP transport before 2.1.0.
- **Configurations:** Systems where management authentication is disabled or not properly configured.
## Vulnerability Description
The vulnerability resides in the HTTP transport layer of the Bifrost gateway. It allows an unauthenticated, remote attacker to execute arbitrary commands on the underlying gateway server. The flaw is triggered via a single, specially crafted HTTP request sent to the management interface, bypassing intended access controls when authentication is absent.
## Exploitation
- **Status:** PoC availability/In-the-wild status not explicitly detailed in the snippet, but the high CVSS score suggests immediate risk.
- **Complexity:** Low (Single HTTP request)
- **Attack Vector:** Network (Unauthenticated)
## Impact
- **Confidentiality:** Total (Attacker can access all data on the server)
- **Integrity:** Total (Attacker can modify or delete system files/configurations)
- **Availability:** Total (Attacker can shut down the service or render it unusable)
## Remediation
### Patches
- **Upgrade to Bifrost version 2.1.0 or later.** This version addresses the flaw in the HTTP transport layer and implements necessary security checks.
### Workarounds
- **Enable Management Authentication:** Ensure that management authentication is strictly enforced for all administrative interfaces.
- **Network Segmentation:** Restrict access to the Bifrost management port to trusted internal IP addresses only via firewalls or Security Groups.
## Detection
- **Indicators of Compromise:** Unusual outbound network traffic from the Bifrost gateway; unexpected processes running under the gateway's user account; unauthorized entries in the HTTP access logs targeting management endpoints.
- **Detection methods and tools:** Monitor system logs for unauthorized access attempts to the management interface. Use vulnerability scanners updated with the latest signatures for CVE-2026-90898.
## References
- **Vendor Advisory:** [hXXps://github[.]com/bifrost-ai/bifrost/security/advisories] (Defanged)
- **CVE Database:** [hXXps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-90898] (Defanged)