EUVD-2026-77357
GHSA-gqjq-cgxr-8c7c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Default config disables auth, so PR:N and AC:L for a single network request; arbitrary process execution as the gateway user yields full C/I/A within an unchanged scope.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.
The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).
transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.
AnalysisAI
Unauthenticated remote code execution in Maxim AI's Bifrost LLM gateway (transports v2.0.0 and earlier) allows any network caller to run arbitrary programs as the gateway process user. Bifrost's management API registers MCP stdio clients as a raw command-plus-args pair and launches that program immediately upon registration with no MCP handshake, and because governance.auth_config.is_enabled defaults to false, a single POST /api/mcp/client requires no credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to Bifrost's management API and that governance auth remain at its default is_enabled=false, under which every caller is treated as a local admin; a single unauthenticated POST /api/mcp/client registering a stdio (command+args) client is sufficient, with no MCP handshake and no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue rather than an inflated high-CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Bifrost transports v2.1.0 or later (https://github.com/maximhq/bifrost/releases/tag/transports/v2.1.0), which rejects unauthenticated stdio MCP client registration with HTTP 403. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Bifrost transports version 2.0.0 or earlier and assess which systems are internet-facing or accessible from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Rated mediu
Improper authorization in Bifrost's vtoken-minting and slpx Substrate pallets lets any signed on-chain account attribute
Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other se
Bifrost HTTP transport before version 2.0.0 exposes an unauthenticated plugin installation endpoint (POST /api/plugins)
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today