Is CVE-2026-90898 known to be exploited?

It is not marked known-exploited in this record.

CVE-2026-90898

Update Bifrost to version 2.1.0 or later, which addresses the vulnerability by properly enforcing management authentication. For organizations unable to update immediately, implement management authentication configuration, restrict network exposure of the gateway management interface, and monitor for suspicious HTTP requests targeting the Bifrost management endpoint.

Quick answers

What is CVE-2026-90898?: Update Bifrost to version 2.1.0 or later, which addresses the vulnerability by properly enforcing management authentication. For organizations unable to update immediately, implement management authentication configuration, restrict network exposure of the gateway management interface, and monitor for suspicious HTTP requests targeting the Bifrost management endpoint.
How severe is CVE-2026-90898?: critical, CVSS 9.8
Is CVE-2026-90898 known to be exploited?: It is not marked known-exploited in this record.
How should CVE-2026-90898 be mitigated?: Update Bifrost to version 2.1.0 or later, which addresses the vulnerability by properly enforcing management authentication. For organizations unable to update immediately, implement management authentication configuration, restrict network exposure of the gateway management interface, and monitor for suspicious HTTP requests targeting the Bifrost management endpoint.

CVSS

9.8

Vendor

—

Published

Sep 30, 2026 · 08:42

Patch

Unknown / not confirmed

Affected products

Bifrost

Mitigation

Critical Bifrost AI Gateway Vulnerability Allows Unauthenticated Remote Code Execution

A critical remote code execution vulnerability in the Bifrost AI gateway HTTP transport component allows unauthenticated attackers to execute arbitrary commands on the server with a single HTTP request. Tracked as CVE-2026-90898 with a CVSS score of 9.8, the flaw affects all versions before 2.1.0 when management authentication is not properly configured. The open-source gateway routes requests to over 20 LLM providers, making compromised servers a significant risk for broader infrastructure compromise.

11m

CVE-2026-90898

Quick answers

Related News

Critical Bifrost AI Gateway Vulnerability Allows Unauthenticated Remote Code Execution