Skip to content
OpenAdvisories

Vendor

maximhq

3 known vulnerabilities.

Products

Bifrost 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.1
    CVE-2026-86242 Scanner template

    Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds

    Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loade…

    maximhq Bifrost
  • High 8.7
    CVE-2026-55245

    Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL

    Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade N…

    maximhq Bifrost github.com/maximhq/bifrost/core Go