{"id":"CVE-2026-90898","title":"Bifrost registers MCP clients through its management API","summary":"Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.\n\n\n\nThe default is governance.auth_conf…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-284","CWE-306"],"vendor":"maximhq","product":"github.com/maximhq/bifrost/transports","affected":["github.com/maximhq/bifrost/transports < 2.1.0"],"published":"2026-09-14","updated":"2026-09-18","sourceUpdated":"2026-09-18T19:31:11.370","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90898","references":[{"url":"https://github.com/maximhq/bifrost","label":"reefs@jfrog.com"},{"url":"https://github.com/maximhq/bifrost/commit/12e170352bd25eab1ae9ba16611f1797d1fd8fdc","label":"reefs@jfrog.com"},{"url":"https://github.com/maximhq/bifrost/pull/6757","label":"reefs@jfrog.com"},{"url":"https://github.com/maximhq/bifrost/releases/tag/transports/v2.1.0","label":"reefs@jfrog.com"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00343,"epssPercentile":0.27967,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-14T11:01:44.207374Z"},"ingestedAt":"2026-09-14T15:23:07.462Z","exploits":{"github":1,"githubRepos":["https://github.com/HORKimhab/CVE-2026-90898"],"checkedAt":"2026-09-24T07:53:24.966Z"},"exploitAvailable":true,"slug":"CVE-2026-90898","body":"## Overview\n\nBifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.\n\n\n\nThe default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).\n\n\n\n transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":66,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":210042,"id":"CVE-2026-90898","ts":1790237909953,"field":"exploit_available","old":"false","new":"true"}]}