CVE-2026-90898 Scanner
CVE-2026-90898 Scanner - Remote Code Execution (RCE) vulnerability in Bifrost
Used 9 times · 4.2k assets checked · domain, subdomain, ipv4
CVE
CVE-2026-90898
9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description
Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image). transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
bifrost
Updated Nov 6, 2026View on NVD →
S4E scanner
CVE history: bifrost
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →