Bifrost custom plugin HTTP URL RCE/SSRF (CVE-2026-86242)
Vulnerability
Summary
Hide ▲
Show ▼
Disclosed on September 6, CVE-2026-86242 gives Bifrost an unauthenticated path to remote code execution through custom plugin registration, with SSRF on builds where code execution is blocked. The flaw affects custom Go plugin support and is strongest on dynamically linked builds that load attacker-controlled code. The fix is in transports/v2.0.0, which closes the unauthenticated plugin-registration path.
Related Happenings
AI coding agents plugin pinning bypass security flaw
Vulnerability
H score60
First: 18.09.2026 14:01
Last: 18.09.2026 14:01
Sources 1
About this happening:
Plugin pinning bypass in four AI coding agents lets a repository owner swap a supposedly reviewed plugin for malicious code, turning a trusted add-on into a code-execu...
AI coding agents plugin pinning bypass security flaw
VulnerabilityAbout this happening: Plugin pinning bypass in four AI coding agents lets a repository owner swap a supposedly reviewed plugin for malicious code, turning a trusted add-on into a code-execu...
Timeline
-
22.09.2026 19:41 1 articles · 2h ago
Bifrost custom plugin flaw enables unauthenticated code execution on dynamically linked builds
Initial DisclosureOn September 6, 2026, researchers disclosed CVE-2026-86242 in Bifrost, where an unauthenticated attacker can register a custom plugin whose path is an HTTP URL. On dynamically linked builds that support custom Go plugins, the plugin loads and runs as the gateway process user; on statically linked builds, including the official Docker image, plugin.Open fails and the outcome is server-side request forgery only.
Show sources
- Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials — thehackernews.com — 22.09.2026 19:41
-
22.09.2026 19:41 2 articles · 2h ago
Bifrost operators are told to enable management authentication and restrict listener exposure
Mitigation Patch UpdateOperators who cannot immediately harden deployments are told to set governance.auth_config.is_enabled to true, use strong credentials, and keep the management listener off untrusted networks. JFrog also advises treating any instance that ran with authentication disabled and the management API exposed as compromised, and rotating virtual keys and provider API keys.
Show sources
- Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials — thehackernews.com — 22.09.2026 19:41
- Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials — thehackernews.com — 22.09.2026 19:41