Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-09-22 16:41 UTC
Importiert: 2026-09-28 20:02 UTC
CVSS: 9.8
Quelle-ID: thn_global
uid_hash: f6c9b6f6bb79a0124fff02ce8256dd705d89f8bec1ab07e58ea92d70ad14d600

The Hacker News

Inhalt

A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request.

The flaw, tracked as CVE-2026-90898 (CVSS score: 9.8), affects all versions of the Bifrost HTTP transport before 2.1.0 when management authentication is

Verknuepfte CVEs

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-90898	CRITICAL	9.8	CRITICAL	9.8			2026-09-14

Quellen-Details

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
The Hacker News	thn_global	security_news		-	de	https://feeds.feedburner.com/TheHackersNews

Zurueck zur Eintrags-Liste