Bifrost AI gateway flaw permits unauthenticated command execution

A critical Bifrost vulnerability lets an unauthenticated attacker execute arbitrary commands on servers running affected versions of the open-source AI gateway. CVE-2026-90898 affects the HTTP transport before version 2.1.0 when management authentication is disabled, the default setting. An attacker can register a standard-input-and-output Model Context Protocol client through one POST request, causing Bifrost to start a chosen command as the gateway user. That access can expose credentials for connected model providers. The stock binary limits the management interface to localhost, but the official Docker image listens on all interfaces. Version 2.1.0 fixes the flaw; neither Bifrost vulnerability was listed as actively exploited at publication.