CVE-2026-90898

{
  "etk_id": "ETK-2026-2538",
  "cve_id": "CVE-2026-90898",
  "display_id": "CVE-2026-90898",
  "ghsa_id": "GHSA-gqjq-cgxr-8c7c",
  "euvd_id": "EUVD-2026-77357",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated command execution in Bifrost MCP registration",
  "summary": "Bifrost transports before 2.1.0 permits unauthenticated registration of stdio MCP clients through its management API when authentication is disabled. An attacker who can reach that API can cause the gateway to launch a program using the Bifrost service account.",
  "mitigation": "Enable authentication for the management API and restrict its network exposure. Upgrade github.com/maximhq/bifrost/transports to version 2.1.0 or later.",
  "vendor": "maximhq",
  "product": "Bifrost",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.1.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.1.0"
      ],
      "package_name": "github.com/maximhq/bifrost/transports",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "other",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0231,
  "epss_percentile": 0.8327,
  "epss_asof": "2026-10-23",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.0027022166666666667,
  "t0_at": "2026-09-14T10:18:53.454000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-24T13:51:39.554084+00:00",
      "days": 40.147755788009256,
      "is_lower_bound": false,
      "measured_at": "2026-09-14T10:18:53.454000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-10-23T00:00:00+00:00",
      "days": 39,
      "is_lower_bound": false,
      "measured_at": "2026-09-14T10:18:53.454000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-90898"
    },
    "public_poc": {
      "at": "2026-10-24T13:51:39.565817+00:00",
      "days": 40.14775592380787,
      "is_lower_bound": false,
      "measured_at": "2026-09-14T10:18:53.454000+00:00",
      "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-90898.yaml"
    },
    "trigger_signal": {
      "at": "2026-10-23T00:00:00+00:00",
      "days": 38.57021465277778,
      "is_lower_bound": false,
      "measured_at": "2026-09-14T10:18:53.454000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-90898"
    }
  }
}