CRITICAL BIFROST AI GATEWAY FLAW LETS ATTACKERS RUN COMMANDS WITHOUT CREDENTIALS

Summary from the TLDR InfoSec newsletter

Bifrost, an open-source AI gateway for 20+ LLM providers, ships with management auth disabled by default, so a single unauthenticated POST to /api/mcp/client can register a stdio MCP client and run arbitrary commands as the gateway user (CVE-2026-90898, CVSS 9.8). That exposes every stored provider API key. The official Docker image binds the management API to 0.0.0.0, and v2.0.0 only fixed a related plugin-loading flaw (CVE-2026-86242, CVSS 8.1). Upgrade to transports/v2.1.0 or set governance.auth_config.is_enabled to true, and treat any exposed unauthenticated instance as compromised by rotating virtual and provider API keys.