Why it matters
Bifrost is an MCP gateway/proxy — a control-plane component that brokers tool access for AI agents. Unauthenticated remote code execution in the gateway itself compromises every agent and every downstream tool/service the gateway mediates, not just a single tool call.
Attack vector
Bifrost's MCP client-management API starts a stdio-client process (command + args) the instant a client is registered via POST /api/mcp/client — no MCP handshake is required and no authentication is enforced by default (auth is off by default in the gateway). A single unauthenticated POST lets a remote attacker run an arbitrary program as the Bifrost gateway process user (appuser on the official image).
Affected systems
maximhq/Bifrost transports < 2.1.0 (governance.auth_config.is_enabled=false by default)
Mitigation
Upgrade to transports/v2.1.0, which rejects unauthenticated stdio registration with HTTP 403. Prior versions (v2.0.0 and earlier) must have governance.auth_config.is_enabled explicitly turned on and the management API restricted to trusted networks as an interim mitigation.