[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fP6mP6iedIHkeD2YZDbN7kGUj_y4CY0vV-0zsI5TUuG4":3},{"article":4,"iocs":53,"watch_terms":64,"solutions":65,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"6f661bc9-2c85-43af-b328-e42fa69bfc91","Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials","critical-bifrost-ai-gateway-flaw-lets-attackers-run-commands-without-credentials-ba859a","A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request. The flaw, tracked as CVE-2026-90898 (CVSS score: 9.8), affects all versions of the Bifrost HTTP transport before 2.1.0 when management authentication is","A critical vulnerability (CVE-2026-90898, CVSS 9.8) in the open-source Bifrost AI gateway allows unauthenticated attackers to run arbitrary commands on the server by exploiting the default disabled management authentication. A second flaw (CVE-2026-86242, CVSS 8.1) allows custom plugin registration via HTTP URLs, leading to command execution or SSRF. Both issues stem from the default unauthenticated state of the management API.","Critical Bifrost AI Gateway flaw allows unauthenticated command execution.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fcritical-bifrost-ai-gateway-flaw-lets.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEieRvfWKvxkIOajVIJ1qC7l54ZBCtHMwZTfUHGqSZ_35vGzAl23py6GfaqrxYkcfWZ_K75t9BGC6btqJQiS9jwaV7O4kJsCSIIQxmn9VnZrBbdjxSN4AzQ05K9G-ES82qV1G6IUcsBetsb0mVO5e5IHTr2FyAA3gtCN8Vne5N1H5Swgd2FLLlwi0GXFQ0o\u002Fs1600\u002Fbifrost.jpg","2026-09-22T16:41:12+00:00","2026-09-22T18:00:07.936654+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"Bifrost","product",{"name":21,"type":22},"LLM","technology",{"name":24,"type":25},"JFrog","vendor",{"name":27,"type":22},"AI Gateway",{"name":29,"type":22},"MCP","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,38,43,48],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61],{"type":55,"value":56,"context":57},"cve","CVE-2026-90898","Critical vulnerability in Bifrost AI Gateway allowing unauthenticated command execution.",{"type":55,"value":59,"context":60},"CVE-2026-86242","Related vulnerability in Bifrost AI Gateway allowing custom plugin registration via HTTP URL.",{"type":55,"value":62,"context":63},"CVE-2026-55245","Unrelated SSRF flaw in Bifrost fixed in late August.",[24,18],{"controls":66,"vendors":153},[67,96,124],{"slug":68,"name":69,"problem":70,"products":71},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":97,"name":98,"problem":99,"products":100},"patch-management","Automated patch management","Known holes get closed in days, not months.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":97,"product_name":121,"url":122,"description":123},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":125,"name":126,"problem":127,"products":128},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",[154],{"slug":155,"name":24,"logo_path":156,"roles":157},"jfrog","\u002Fvendor-logos\u002Fjfrog.png",[158],"reported_by",{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":176},"bifrost-ai-gateway-defaults-leave-servers-wide-open-to-unauthenticated-command-execution","Bifrost AI Gateway Defaults Leave Servers Wide Open to Unauthenticated Command Execution","Both critical vulnerabilities in the Bifrost AI gateway stem from a single root failure: authentication is disabled by default on the management API, meaning any attacker with network access can execute arbitrary commands without credentials. This 'secure by default' failure is a foundational misconfiguration that should never reach production, let alone be the default state of an internet-facing gateway. The secondary flaw compounding the risk allows untrusted HTTP URLs to register custom plugins, creating additional command execution and SSRF attack surfaces. As AI gateway adoption accelerates, insecure default configurations in these components represent an emerging and high-impact attack vector across enterprises. Organizations deploying open-source AI infrastructure must treat hardening defaults as a mandatory deployment prerequisite, not an optional step.",[164,165,166,167,168,169,170,171,172,173,174,175],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 6: Access Control Management","CIS Control 7: Continuous Vulnerability Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF ID.CM-8: Information System Component Inventory","OWASP API Security Top 10: API2 - Broken Authentication","OWASP API Security Top 10: API8 - Security Misconfiguration",{}]