CVE-2026-90898: Bifrost unauthenticated remote code execution via MCP stdio client registration

Is it exploited?

Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of 29 Oct 2026.

VulnCheck KEV lists it since 23 Oct 2026. VulnCheck's own honeypots also recorded exploitation attempts.

How likely is exploitation in the next 30 days?

2.3%

EPSS score, percentile 83.3 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?

9.8 Critical

CVSS v3.1 base score, given by the CNA

What should I do?

Upgrade Bifrost HTTP transport to 2.1.0 or later. Full textSolution from the CVE record.

CISA has set no required action, because the vulnerability is not in KEV.

Advisories and patches (3)

Which versions are affected?

Affected

• before 2.1.0

Versions by product

Source: CISA KEV 2026.10.29, as of 29 Oct 2026; VulnCheck KEV, as of 30 Oct 2026; FIRST EPSS, as of 29 Oct 2026; CVE List, as of 30 Oct 2026. About the data.

Description

Bifrost unauthenticated remote code execution via MCP stdio client registration

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).  transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.

Source: CVE List, as of 30 Oct 2026. About the data.

What to do

Advisories and patches

• PR #6757: refuse unauthenticated stdio MCP registration (Patch)
• Merge commit for PR #6757 (Patch)
• Bifrost HTTP v2.1.0 (first release containing the fix) (Release notes)

Solution (from the CVE record)

Upgrade Bifrost HTTP transport to 2.1.0 or later. PR #6757 returns 403 for unauthenticated stdio MCP client registration when dashboard authentication is disabled or unconfigured. Authenticated admins can still add stdio clients. The 1.6.x line through 1.6.11 and transports/v2.0.0 do not include this change.

Workaround (from the CVE record)

Set governance.auth_config.is_enabled to true, use strong administrator credentials, and firewall the management listener.

This summary is based on the CVE record as of 30 Oct 2026. Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

Source: CVE List, as of 30 Oct 2026. About the data.

Timeline