Description
Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.
The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).
transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| maximhq | Bifrost | < 2.1.0 | 2.1.0 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
HORKimhab/CVE-2026-90898 ★ 0 · Sep 23, 2026
CVE-2026-90898 - Draft or TODO
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Bifrost < 2.1.0 - Unauthenticated MCP Stdio Command Execution http/cves/2026/CVE-2026-90898.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.