/Vulnerability Library

Bifrost < 1.6.3 - Unauthenticated Remote Plugin URL Fetch

CVE-2026-86242
Early Release

Description

When dashboard authentication is disabled, Bifrost accepts an enabled custom plugin with an HTTP URL as its path. The gateway fetches the URL before attempting to load it. This template confirms the unauthenticated server-side request with an out-of-band callback; it does not assert code execution on statically linked builds.

Severity

High

CVSS Score

8.1

Exploit Probability

4%

Affected Product

bifrost

Published Date

October 5, 2026

Template Author

alex700

CVE-2026-86242.yaml
8.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-86242
CWE ID:
cwe-94

References

https://github.com/maximhq/bifrost/security/advisories/GHSA-2qp8-4xgm-fw6ghttps://nvd.nist.gov/vuln/detail/CVE-2026-86242

Remediation Steps

Upgrade Bifrost to a release that requires genuine admin authentication for custom plugin paths, such as transports v2.1.0 or later, and enable dashboard authentication.