What happened
JFrog Security Research (Yuval Moravchik) disclosed CVE-2026-90898 (CVSS 9.8): because management API authentication is disabled by default, an attacker can register a stdio MCP client whose command runs as the gateway process user before any MCP handshake. A related plugin-loading flaw CVE-2026-86242 (CVSS 8.1) allows unauthenticated plugin registration over HTTP (RCE on dynamically-linked builds, SSRF on the static Docker image).
Why it matters
Bifrost concentrates LLM provider API keys, model routing, and MCP tool trust in one process. Unauthenticated command execution here means arbitrary code as the gateway user plus theft of stored LLM provider credentials — an AI-infrastructure equivalent of the actively-exploited LiteLLM command-injection flaw that reached CISA KEV in June 2026.
Attack vector
Unauthenticated single POST to /api/mcp/client registers a stdio-type MCP client with an attacker-supplied command; the gateway spawns the command immediately, before any MCP handshake, executing as the gateway process user (appuser in Docker).
Affected systems
Bifrost AI Gateway HTTP transport < 2.1.0 (MCP gateway with management API; Docker image binds management API externally).
Mitigation
Upgrade to Bifrost HTTP transport 2.1.0 or later (returns 403 for unauthenticated stdio registration); enable management API authentication; keep the management listener off untrusted networks; treat any exposed instance that ran with auth disabled as potentially compromised (JFrog guidance).