Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Disclosed vulnerability

CVE-2026-90898: unauthenticated RCE in Bifrost via MCP stdio client registration

AIR-2026-0241 AIR record · 2026-09-bifrost-mcp-client-unauth-rce
Open in dashboard About
From the supporting source
One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).cveawg.mitre.org
The record
Disclosed
2026-09-14
Vendor
Maxim (maximhq)
Product
Bifrost (AI gateway)
Risk domain
Access control and permissions › Confused deputy
Also touches
Privilege escalation
System type
Generative model
Who acted
AI was the target — MCP client registration RCE; no model decision
Attack surface
MCP server
Autonomy level
Assistant
Initial vector
Unauthenticated network request
Impact type
Remote code execution, Server side request forgery
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI03 – Identity and Privilege Abuse
MITRE ATLAS
AML.T0054 – LLM Jailbreak
NIST AI RMF
GOVERN 6.1
EU AI Act
—
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool misuse
Mitigation
Validate delegation chains; Use signed attestations.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Bifrost transports < 2.1.0 with default governance.auth_config.is_enabled=false
Capability abused
mcp_client_registrationlocal_process_spawn
Defense & remediation
Recorded defense
governance auth (disabled by default)
Guardrail kinds
Authentication
Guardrail outcome
Not enabled
Fix shipped
Bifrost transports/v2.1.0
Taxonomy & references
OWASP ASI05 Unexpected Code Execution (RCE)OWASP ASI03 Identity and Privilege AbuseCVE-2026-90898missing_authenticationremote_code_executionmcp_client_registrationssrfai_gateway
Curator notes
CVSS 9.8. Assigned by JFrog; reported by Yuval Moravchick (JFrog). Registering a stdio MCP client makes Bifrost exec() an arbitrary command; an http/sse client enables SSRF to 169.254.169.254. Fixed by refusing unauthenticated stdio/private-target registration (403). PoC/disclosure; no real victim.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-90898: unauthenticated RCE in Bifrost via MCP stdio client registration". AIR, AIR-2026-0241. https://agentincident.vercel.app/i/AIR-2026-0241/ (accessed 2026-10-19).