VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2026/90xxx/CVE-2026-90898.json
T

259 lines
12 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-90898",
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"state": "PUBLISHED",
"assignerShortName": "JFROG",
"dateReserved": "2026-09-14T10:13:28.161Z",
"datePublished": "2026-09-14T10:18:53.454Z",
"dateUpdated": "2026-09-14T11:19:46.276Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG",
"dateUpdated": "2026-09-14T10:18:53.454Z"
},
"title": "Bifrost unauthenticated remote code execution via MCP stdio client registration",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "maximhq",
"product": "Bifrost",
"platforms": [
"Linux",
"macOS"
],
"collectionURL": "https://github.com/maximhq/bifrost",
"packageName": "github.com/maximhq/bifrost/transports",
"repo": "git://github.com/maximhq/bifrost",
"modules": [
"transports/bifrost-http",
"core/mcp"
],
"programFiles": [
"transports/bifrost-http/handlers/mcp.go",
"transports/bifrost-http/handlers/middlewares.go"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.1.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.\n\n\n\nThe default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).\n\n\n\n transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.</p><p>The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).</p><p>&nbsp;transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.</p>"
}
]
}
],
"references": [
{
"url": "https://github.com/maximhq/bifrost/pull/6757",
"name": "PR #6757: refuse unauthenticated stdio MCP registration",
"tags": [
"patch"
]
},
{
"url": "https://github.com/maximhq/bifrost/commit/12e170352bd25eab1ae9ba16611f1797d1fd8fdc",
"name": "Merge commit for PR #6757",
"tags": [
"patch"
]
},
{
"url": "https://github.com/maximhq/bifrost/releases/tag/transports/v2.1.0",
"name": "Bifrost HTTP v2.1.0 (first release containing the fix)",
"tags": [
"release-notes"
]
},
{
"url": "https://github.com/maximhq/bifrost",
"name": "Bifrost repository",
"tags": [
"product"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "CRITICAL",
"baseScore": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"configurations": [
{
"lang": "en",
"value": "Management API reachable and governance.auth_config.is_enabled=false, which is the documented default. Confirmed on maximhq/bifrost v1.6.3. Fixed in transports/v2.1.0 (2026-09-08). An operator who enables management authentication and keeps the admin listener off untrusted networks is not exposed to the unauthenticated form of this issue.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Management API reachable and governance.auth_config.is_enabled=false, which is the documented default. Confirmed on maximhq/bifrost v1.6.3. Fixed in transports/v2.1.0 (2026-09-08). An operator who enables management authentication and keeps the admin listener off untrusted networks is not exposed to the unauthenticated form of this issue.</p>"
}
]
}
],
"workarounds": [
{
"lang": "en",
"value": "Set governance.auth_config.is_enabled to true, use strong administrator credentials, and firewall the management listener.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Set governance.auth_config.is_enabled to true, use strong administrator credentials, and firewall the management listener.&nbsp;</p>"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade Bifrost HTTP transport to 2.1.0 or later. PR #6757 returns 403 for unauthenticated stdio MCP client registration when dashboard authentication is disabled or unconfigured. Authenticated admins can still add stdio clients. The 1.6.x line through 1.6.11 and transports/v2.0.0 do not include this change.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Upgrade Bifrost HTTP transport to 2.1.0 or later. PR #6757 returns 403 for unauthenticated stdio MCP client registration when dashboard authentication is disabled or unconfigured. Authenticated admins can still add stdio clients. The 1.6.x line through 1.6.11 and transports/v2.0.0 do not include this change.</p>"
}
]
}
],
"exploits": [
{
"lang": "en",
"value": "JFrog has a private proof of concept. An unauthenticated POST /api/mcp/client with connection_type stdio and attacker-chosen command and args starts the program in the gateway. Public exploit details are not included in this record.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>JFrog has a private proof of concept. An unauthenticated POST /api/mcp/client with connection_type stdio and attacker-chosen command and args starts the program in the gateway. Public exploit details are not included in this record.</p>"
}
]
}
],
"timeline": [
{
"time": "2026-07-13T10:27:00.000Z",
"lang": "en",
"value": "Reported to the Bifrost maintainers (GHSA-86gf-xh3g-rvxq)"
},
{
"time": "2026-09-02T15:14:00.000Z",
"lang": "en",
"value": "Fix merged upstream (PR #6757)"
},
{
"time": "2026-09-08T15:15:00.000Z",
"lang": "en",
"value": "Fix first shipped in Bifrost HTTP v2.1.0"
}
],
"credits": [
{
"lang": "en",
"value": "Yuval Moravchick | JFrog",
"type": "finder"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"id": "CVE-2026-90898",
"role": "CISA Coordinator",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"version": "2.0.3",
"timestamp": "2026-09-14T11:01:44.207374Z"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-09-14T11:19:46.276Z"
}
}
]
}
}
View Git Blame Copy Permalink