2026年9月22日 12:41 ET 发布 · 更新于 2 个月前 · 1 个来源
Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials
The Hacker News
·
原始报道
A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request. The flaw, tracked as CVE-2026-90898 (CVSS score: 9.8), affects all versions of the Bifrost HTTP transport before 2.1.0 when management authentication is
原文