Critical Bifrost AI gateway flaw allows commands without login

A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more than 20 large language model providers, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request, according to a report published by The Hacker News on 22 September 2026.

The flaw is tracked as CVE-2026-90898 and carries a CVSS score of 9.8, near the top of the ten-point severity scale. According to the report, it affects all versions of the Bifrost HTTP transport before 2.1.0 when management authentication is not properly enabled. That condition matters: the issue is reachable where the gateway's administrative interface has been left without the authentication controls that are supposed to guard it.

AI gateways such as Bifrost sit between applications and model providers, acting as a single point through which prompts, responses and provider credentials pass. That position is what makes a flaw of this kind serious. A component that can reach more than 20 providers is, by design, holding the keys and the traffic for everything behind it. Command execution on the host running such a gateway would put the attacker on the same machine as that traffic.

The requirement for no valid credentials, and for only a single HTTP request, lowers the bar for exploitation considerably. There is no need for an attacker to first obtain a token, phish an operator, or chain several weaknesses together. Anything that can reach the gateway over the network can, on an affected and misconfigured deployment, attempt it.

The root cause here is best understood as a misconfiguration exposure rather than a purely accidental coding error: the dangerous path is open where management authentication has not been properly switched on. That distinction is important for defenders because it means the population of exposed systems depends heavily on how each operator deployed the software. Teams that stood Bifrost up quickly for internal testing, and then left it running, are the most likely to be in scope.

The fix line given in the report is version 2.1.0 of the HTTP transport. Operators running anything earlier should treat upgrading as the primary remedy, and should verify that management authentication is enabled rather than assuming it is on by default. Checking whether the management interface is reachable from untrusted networks is a reasonable second step while upgrades are scheduled.

The Hacker News report does not describe exploitation in the wild, and no further details on discovery or disclosure timeline were available in the material reviewed for this article. The vulnerability is recorded as reported.