CVE-2026-90898 allows unauthenticated attackers to execute arbitrary commands on Bifrost AI gateway servers with a single HTTP request, according to a disclosure published September 22, 2026.
Bifrost is an open-source AI gateway that routes requests to over 20 LLM providers. The vulnerability, scored CVSS 9.8, affects all Bifrost HTTP transport versions prior to 2.1.0 when management authentication is enabled. The flaw has been patched in version 2.1.0.
Bifrost Routes Requests to 20+ LLM Providers as AI Gateway
Bifrost functions as a unified API gateway for organizations integrating multiple large language model providers into applications. The platform routes requests from client applications to LLM backends including OpenAI, Anthropic, Cohere, and other providers, abstracting provider-specific API differences behind a single interface.
Organizations deploy Bifrost to centralize LLM access, enforce rate limiting and cost controls, and switch between providers without modifying application code. The gateway sits between internal applications and external LLM services, processing authentication, request routing, response handling, and usage metering.
CVE-2026-90898 Enables Unauthenticated RCE via Single HTTP Request
CVE-2026-90898 allows an unauthenticated attacker to execute arbitrary operating system commands on the Bifrost gateway server by sending a crafted HTTP request to the management interface. The flaw does not require valid credentials, prior access to the system, or user interaction.
The vulnerability exists in Bifrost’s HTTP transport implementation when management authentication is enabled. The specific code path vulnerable to exploitation was not detailed in the public disclosure, but the outcome is clear: an attacker can run commands on the gateway server with the privileges of the Bifrost process.
For organizations using Bifrost as their LLM gateway, this vulnerability represents complete infrastructure compromise. An attacker achieving code execution on the gateway can intercept LLM requests and responses, extract API keys for all configured LLM providers, modify responses sent to internal applications, or pivot to other systems on the network.
Affects Bifrost HTTP Transport Versions Prior to 2.1.0
The vulnerability affects all versions of Bifrost’s HTTP transport implementation before version 2.1.0, but only when management authentication is enabled. Organizations running Bifrost without management authentication enabled are not vulnerable to CVE-2026-90898.
The patch was released in Bifrost version 2.1.0 on September 22, 2026. Organizations running earlier versions with management authentication enabled must upgrade immediately to eliminate the unauthenticated remote code execution risk.
Critical Impact for Organizations Using Bifrost in Production
Organizations deploying Bifrost as a production AI gateway face a critical exposure window. The unauthenticated nature of the exploit means any network-accessible Bifrost instance with management authentication enabled could be compromised by attackers scanning for vulnerable gateways.
Bifrost gateways typically have access to API keys for every LLM provider configured in the routing table. Compromise of the gateway exposes these credentials, granting attackers the ability to consume LLM services under the victim organization’s accounts, exfiltrate API usage data, or poison responses sent to internal applications relying on the gateway.
Immediate Upgrade to Version 2.1.0 Required
Users must upgrade to Bifrost version 2.1.0 immediately. The severity of the vulnerability—unauthenticated remote code execution on AI infrastructure—tolerates no delay. Organizations that cannot upgrade immediately should disable management authentication or block network access to the Bifrost management interface until the patch can be applied.
After upgrading, organizations should audit Bifrost server logs for unauthorized access attempts, review configured LLM provider API keys and rotate them if compromise is suspected, and inspect application behavior for anomalies that could indicate response poisoning during the vulnerability window.
The disclosure did not indicate whether CVE-2026-90898 has been exploited in the wild, name the researcher who discovered the flaw, or provide indicators of compromise for organizations seeking to determine whether their Bifrost deployments were targeted.
Bifrost’s role as a central chokepoint for LLM access makes it a high-value target. A single vulnerability in the gateway infrastructure can expose every LLM provider credential, every internal application’s queries, and every response sent back to users. CVE-2026-90898’s CVSS 9.8 score accurately reflects the severity of unauthenticated remote code execution in this context.
