Vibe Coding
A critical unauthenticated RCE in the Bifrost MCP gateway: registering a stdio client runs a program on the box
CVE-2026-90898, published 2026-09-14 with a CVSS base score of 9.8, covers Maxim's Bifrost LLM gateway, which registers MCP clients through its management API. A stdio client is a command plus args, and Bifrost launches that program the moment the client is added, with no MCP handshake required. Because `governance.auth_config.is_enabled` defaults to false, a single unauthenticated `POST /api/mcp/client` runs code as the gateway process user (`appuser` on the official image); `transports/v2.1.0` refuses unauthenticated stdio registration with 403, `transports/v2.0.0` still allows it.
Source
↳ Follow the thread