Description

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).  transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-14T11:17:08.237Z",
  "pubdate": "2026-09-14T11:17:08.237Z",
  "executiveSummary": "Bifrost contains a critical vulnerability stemming from insecure default configuration and insufficient access control within the MCP client registration process. By design, the management API fails to enforce authentication when governance.auth_config.is_enabled is set to false, which is the default state.\nThis vulnerability allows an unauthenticated actor to interact with the POST /api/mcp/client endpoint to register stdio clients. Because the system initiates the provided command and arguments immediately upon registration—bypassing any MCP handshake—the attacker gains the ability to execute arbitrary commands on the host operating system.\nThe process runs with the privileges of the Bifrost application user (appuser), leading to a complete compromise of the Bifrost service environment. This flaw is present in version 2.0.0, while 2.1.0 introduces a patch by enforcing a 403 Forbidden response for unauthenticated registration attempts.\nThe risk is critical due to the lack of required authentication, allowing any entity with network access to the API to achieve remote command execution. Immediate remediation through upgrading to version 2.1.0 or enabling strict authentication is required.",
  "technicalDetails": "The vulnerability resides in the Bifrost management API responsible for handling MCP (Model Context Protocol) client registration. The root cause is an improper authentication bypass mechanism where the API relies on a configurable governance module (governance.auth_config) that defaults to a disabled state. When disabled, the API treats all callers as having local administrator privileges, effectively nullifying access controls for sensitive administrative endpoints.\nThe vulnerable endpoint, POST /api/mcp/client, is designed to accept a command string and corresponding arguments for stdio-based clients. Bifrost's internal logic initiates the specified binary or shell command immediately upon the receipt of the registration payload. Because there is no requisite MCP handshake or validation layer, the gateway executes the payload within the context of the Bifrost process user (appuser).\nAttack flow: 1. An attacker identifies a reachable Bifrost management API endpoint where governance.auth_config.is_enabled is false. 2. The attacker crafts a POST request to /api/mcp/client containing a malicious command or script path intended for execution. 3. The API, lacking authentication enforcement, accepts the request. 4. Bifrost spawns the attacker-controlled process as a child process of the gateway. 5. The arbitrary command executes with the permissions of the application user. 6. The attacker leverages this execution to gain shell access, exfiltrate environment variables, or persist within the host infrastructure.\nThe impact is significant, as it grants the attacker full control over the service's runtime environment, facilitating lateral movement or data theft. While version 2.1.0 resolves this by rejecting unauthenticated registration attempts with a 403 Forbidden status, version 2.0.0 remains critically exposed. The vulnerability is tied directly to the gateway's lack of rigorous input validation and the absence of a mandatory, non-configurable authentication layer for management operations."
}