/Vulnerability Library

Bifrost < 2.1.0 - Unauthenticated MCP Stdio Command Execution

CVE-2026-90898
Verified

Description

When dashboard authentication is disabled, Bifrost accepts an unauthenticated stdio MCP client registration and starts its configured command before the MCP handshake completes. This template runs a benign outbound HTTP request from the target and requires an out-of-band callback to confirm command execution.

Severity

Critical

Exploit Probability

2%

Affected Product

bifrost

Published Date

October 13, 2026

Template Author

alex700

CVE-2026-90898.yaml
9.5Severity

CVSS Metrics

CVE ID:
cve-2026-90898
CWE ID:
cwe-78

References

https://github.com/maximhq/bifrost/pull/6757

Remediation Steps

Upgrade Bifrost to transports v2.1.0 or later and enable dashboard authentication.