Bifrost, an open-source AI gateway used to route requests across more than 20 large language model providers, contains a critical remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands on affected servers. The flaw, designated CVE-2026-90898 with a CVSS severity score of 9.8, impacts all versions of Bifrost's HTTP transport layer prior to version 2.1.0 when management authentication is enabled.
The vulnerability permits attackers to bypass authentication entirely and issue commands to the underlying gateway infrastructure through a single HTTP request. This represents a direct threat to organizations deploying Bifrost as an intermediary layer for LLM integrations. An attacker could gain complete control over the compromised gateway server, potentially accessing sensitive data, manipulating API requests to language models, installing persistence mechanisms, or pivoting to internal networks.
Bifrost's architecture aggregates multiple LLM provider APIs, including those from OpenAI, Anthropic, Google, and others, into a unified interface. Organizations use it to centralize API keys, implement rate limiting, monitor token usage, and route requests based on cost or latency. A compromised Bifrost instance becomes a high-value target because it typically holds API credentials for dozens of third-party services and sits at the perimeter between internal systems and external LLM providers.
The authentication bypass in the HTTP transport layer is the core issue. When management authentication should protect administrative endpoints, the vulnerability allows requests to reach sensitive functionality without valid credentials. Researchers have not disclosed the specific attack vector, but the single-request requirement suggests a straightforward HTTP exploitation technique, likely leveraging a misconfigured route handler or insufficient input validation on a critical endpoint.
Organizations running Bifrost versions before 2.1.0 face immediate risk. Attackers can discover exposed Bifrost instances through network scanning or by identifying them during reconnaissance of organizations known to use LLM infrastructure. Exploitation requires no authentication, no special tools beyond standard HTTP clients, and no knowledge of valid credentials or API keys.
The maintainers of Bifrost have released version 2.1.0, which patches the authentication bypass. Users should apply this update immediately, particularly if their Bifrost instances are accessible from untrusted networks or the internet. Organizations should also assume that instances running vulnerable versions may have been compromised before patching becomes possible.
Additional mitigation steps include restricting network access to Bifrost administrative interfaces through firewall rules or VPN requirements. Implementing application-layer authentication behind a reverse proxy can provide defense in depth. Security teams should audit API credential usage patterns for any signs of unauthorized access or unusual LLM API consumption following discovery of a compromise.
This vulnerability highlights the expanding attack surface created by layering multiple LLM providers behind centralized gateways. While consolidation simplifies API management, a single critical flaw can expose all integrated providers simultaneously. As organizations integrate LLMs deeper into production systems, securing these gateway layers becomes essential. The ease of exploitation and severity of impact make CVE-2026-90898 a priority for any organization running Bifrost infrastructure.