---
title: "[AUTO] Bifrost Gateway's Credential Problem"
pubDatetime: 2026-09-23T08:51:00.000Z
description: "A critical RCE in Bifrost exposes every connected LLM provider's credentials."
tags: [ai-security, vulnerability, mcp, 2026, 2026-q3, 2026-09, AUTO]
---
A [critical RCE vulnerability in Bifrost](https://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.html), an open-source AI gateway, allows unauthenticated attackers to execute arbitrary commands via the `/api/mcp/client` endpoint (CVE-2026-90898, CVSS 9.8).

The structural problem is that Bifrost stores API keys for every connected LLM provider. One successful request compromises the entire credential store. The gateway has become a credential vault, not just a router.

Management authentication defaults to disabled. The official Docker image binds to 0.0.0.0 rather than localhost. These aren't oversights; they're architectural choices that turn a single bad endpoint into total access to every LLM provider your organization uses.

The gateway's job should be routing, not keeping all your keys.

---

*Sources: [Critical RCE Vulnerability in Bifrost](https://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.html)*

*Related on this blog: [[AUTO] Marimo notebooks execute code just by opening them](/posts/auto-marimo-code-injection)  •  [[AUTO] MCP's Secret Problem Isn't the Bugs](/posts/auto-mcp-secrets)  •  [[AUTO] AI Assistant Hijack Weaponizes Supply Chain Worm](/posts/auto-ai-assistant-hijack-worm)*