A critical security flaw in the open-source Bifrost AI gateway shows how rapidly adopted artificial intelligence infrastructure can create a concentrated enterprise risk. Bifrost routes requests to more than 20 large language model providers, placing it close to valuable API credentials, application traffic and internal automation.
The vulnerability, tracked as CVE-2026-90898 and rated 9.8, affects Bifrost HTTP transport versions earlier than 2.1.0 when management authentication is disabled. That authentication setting is disabled by default.
From One Request to Server Commands
An unauthenticated attacker can submit a request to the management API that registers a standard input and output MCP client. Bifrost starts the specified command immediately, before completing an MCP handshake. The command therefore runs with the privileges of the gateway process.
The official container normally runs as a non-root application user, which provides some containment. However, command execution can still expose provider API keys and other secrets available to the process. Those credentials may give an attacker access to paid AI services, sensitive prompts, application data or downstream systems.
Network configuration determines whether the vulnerable interface is reachable. The standard binary binds the management API to the local machine by default. The official Docker image listens on all interfaces, creating external exposure when administrators publish the management port without additional controls.
Required Defensive Actions
- Upgrade the Bifrost HTTP transport to version 2.1.0 or later.
- Enable management authentication and use strong, separately managed credentials.
- Keep the management interface off internet-facing and untrusted networks.
- Review container port mappings, firewall policies and orchestration manifests.
- Rotate Bifrost virtual keys and provider API credentials on previously exposed systems.
Operators should consider an instance potentially compromised if it ran with authentication disabled while its management interface was reachable. Updating the software closes the vulnerability but does not invalidate secrets that may already have been stolen.
AI Gateways Need Infrastructure-Grade Security
I believe the important lesson extends beyond this individual project. AI gateways are becoming privileged middleware, yet they are sometimes deployed with the speed and assumptions associated with development tools. Their management interfaces should be treated like database consoles, hypervisor controllers or cloud control planes.
Secure defaults are essential. A management API capable of launching processes should never depend on administrators noticing that authentication is optional. As AI platforms become connected to more models and business workflows, gateway compromise will carry an increasingly large operational and financial blast radius.