Critical Bifrost AI Gateway Vulnerability Allows Unauthenticated Remote Code Execution

A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request. The flaw, tracked as CVE-2026-90898 (CVSS score: 9.8), affects all versions of the Bifrost HTTP transport before 2.1.0 when management authentication is not properly configured or is bypassed.

According to The Hacker News, the vulnerability enables unauthenticated remote code execution via a single HTTP request. The Bifrost HTTP transport component fails to enforce authentication requirements in certain configurations, allowing attackers to bypass access controls and execute commands on the underlying server.

Successful exploitation could lead to complete server compromise, including data exfiltration, lateral movement within the network, and full control of the AI gateway infrastructure that routes requests to multiple large language model providers. Given the gateway's role as a routing point for LLM provider requests, a compromised server could also be used to manipulate or intercept traffic to these providers.

The vulnerability was disclosed publicly on September 22, 2026. All Bifrost versions prior to 2.1.0 are affected. The maintainers released version 2.1.0 containing a fix that properly enforces management authentication for the HTTP transport component.