Critical Bifrost AI Gateway Bug Lets Attackers Run Commands With No Login Required

Security researchers have disclosed a critical vulnerability in Bifrost, an open-source AI gateway used to route requests to more than 20 large language model providers. The flaw, tracked as CVE-2026-90898 with a near-maximum severity score of 9.8, allows an attacker with no credentials to run arbitrary commands on the gateway server using just one HTTP request. It works by registering a malicious client type through an unprotected management API endpoint, causing Bifrost to run the attacker's command immediately as the gateway's process user.

The risk is heightened because Bifrost stores API keys for every connected AI provider, meaning a compromised gateway can expose all of those credentials. The default configuration leaves management authentication disabled. While the standalone Bifrost binary only exposes this API locally, the official Docker image binds it to all network interfaces, so any business running the containerised version with the port published could be exposed to the internet.

A fix is available in transports/v2.1.0, which blocks unauthenticated registration attempts. Businesses unable to upgrade immediately should enable authentication in the governance settings, use strong credentials, and ensure the management interface is not reachable from untrusted networks. Researchers also recommend treating any instance that ran exposed and unauthenticated as already compromised and rotating all associated API keys. A separate, related flaw allowing malicious plugin loading was also disclosed by the same research team.