A critical RCE vulnerability in Bifrost, an open-source AI gateway, allows unauthenticated attackers to execute arbitrary commands via the /api/mcp/client endpoint (CVE-2026-90898, CVSS 9.8).
The structural problem is that Bifrost stores API keys for every connected LLM provider. One successful request compromises the entire credential store. The gateway has become a credential vault, not just a router.
Management authentication defaults to disabled. The official Docker image binds to 0.0.0.0 rather than localhost. These aren’t oversights; they’re architectural choices that turn a single bad endpoint into total access to every LLM provider your organization uses.
The gateway’s job should be routing, not keeping all your keys.
Sources: Critical RCE Vulnerability in Bifrost
Related on this blog: [AUTO] Marimo notebooks execute code just by opening them • [AUTO] MCP’s Secret Problem Isn’t the Bugs • [AUTO] AI Assistant Hijack Weaponizes Supply Chain Worm