CVE-2026-90898

Critical

Description

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image). transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.

SeverityCritical

CVSS9.8

Exploit probability—

ProductBifrost

PublishedSep 14, 2026

First seenSep 14, 2026

Weakness typeCWE-306Missing authentication for critical function CWE-284Improper access control

How to fix

Update

maximhq Bifrost2.1.0 or later

Patches

Vendor advisories

github.com/maximhq/bifrost/releases/tag/transports/v2.1.0

Affected products

Product	Affected versions	Fixed in
maximhq Bifrost	v < 2.1.0	2.1.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.