GHSA-gqjq-cgxr-8c7cCriticalCVSS 9.8
Bifrost registers MCP clients through its management API. A stdio client is a command plus args....
🔗 CVE IDs covered (1)
📋 Description
Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.
The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).
transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-90898
- https://github.com/maximhq/bifrost/pull/6757
- https://github.com/maximhq/bifrost/commit/12e170352bd25eab1ae9ba16611f1797d1fd8fdc
- https://github.com/maximhq/bifrost
- https://github.com/maximhq/bifrost/releases/tag/transports/v2.1.0
- https://github.com/advisories/GHSA-gqjq-cgxr-8c7c