Published Sep 22, 2026, 12:41 PM ET · Updated 2 months ago · 1 source
Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials
The Hacker News
·
Original Report
A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request. The flaw, tracked as CVE-2026-90898 (CVSS score: 9.8), affects all versions of the Bifrost HTTP transport before 2.1.0 when management authentication is