Bifrost's MCP flaw shows the protocol still has no client-authentication story

JFrog disclosed two critical vulnerabilities in the open-source Bifrost AI gateway during September 2026, including CVE-2026-90898, which allowed unauthenticated attackers to execute arbitrary commands through a single request to an MCP client-registration endpoint. Both flaws stemmed from Bifrost shipping its management API with authentication disabled by default, while its Docker configuration could expose that API publicly when ports were published. The newer vulnerability executed an attacker-provided stdio command immediately when a client was registered, before any MCP handshake, capability negotiation, or authorization occurred. Although Bifrost version 2.1.0 added a setup token to protect initial administrative setup, the discussion argues that the broader issue is not an MCP protocol defect but insecure management-API design. It distinguishes Bifrost’s administrative client registration from OAuth Dynamic Client Registration and concludes that gateways require default authentication, authorization scoped to high-risk administrative actions, and policy checks that assess the potentially dangerous behavior requested before execution.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.