Bifrost EUVD-2026-77357

Exploitation requires network access to Bifrost's management API and that governance auth remain at its default is_enabled=false, under which every caller is treated as a local admin; a single unauthenticated POST /api/mcp/client registering a stdio (command+args) client is sufficient, with no MCP handshake and no user interaction. Limiting factors: it only works against transports v2.0.0 and earlier (v2.1.0 returns 403 for unauthenticated stdio registration), and it is neutralized if governance auth is enabled or the management API is not reachable by the attacker (e.g. bound to loopback or firewalled). The affected version runs the spawned program as the Bifrost process user (appuser on the official image), which bounds post-exploitation privilege.

This is a genuine top-priority issue rather than an inflated high-CVSS score. The CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is well-supported by the description: the default configuration (auth disabled) makes the attack unauthenticated and single-request, and the payload is direct command execution rather than a memory-corruption primitive that must be weaponized. The only meaningful limiter is network reachability of the management API - if the admin/management port is bound to loopback or firewalled to trusted operators, exposure drops sharply. No EPSS score, KEV listing, or public POC is provided, so there is no evidence of active exploitation yet; however, the exploit is so simple (a documented REST call) that low EPSS/POC data should not lower urgency. Any operator exposing Bifrost's management interface beyond localhost should treat this as an emergency patch. The provided GitHub PR diff (SSRF-safe dialing for MCP HTTP clients) is defense-in-depth hardening around the same subsystem and references the actual authorization fix (rejectPrivateMCPTargetIfAuthBypassed), but the core remediation for this CVE is the v2.1.0 403 refusal of unauthenticated stdio registration.

An attacker who can reach the Bifrost management API on a default (auth-disabled) deployment sends a single unauthenticated POST /api/mcp/client registering a stdio client whose command is an attacker-controlled program or shell invocation (e.g. a reverse shell). Bifrost spawns it immediately as 'appuser', with no MCP handshake required, giving the attacker code execution inside the gateway. The low-complexity, single-request nature makes this trivially scriptable and mass-scannable, though no public POC is identified at time of analysis.