CVE-2026-86242: Bifrost HTTP Transport RCE Vulnerability

CVE-2026-86242 Overview

CVE-2026-86242 affects the Bifrost HTTP transport before version 2.0.0, an AI gateway maintained by maximhq. The vulnerability allows unauthenticated attackers to submit a custom plugin whose path is an HTTP URL through POST /api/plugins when management authentication is disabled, which is the default configuration (governance.auth_config.is_enabled=false). The shared-object loader treats the HTTP-prefixed path as a download URL, writes the response body to a temporary .so file, and passes it to Go's plugin.Open. On dynamically linked builds required by the vendor for custom Go plugins, this results in unauthenticated remote code execution as the Bifrost process user.

Critical Impact
Unauthenticated attackers can achieve remote code execution on dynamically linked Bifrost deployments by submitting a malicious shared object URL to the plugin management endpoint.

Affected Products

Bifrost HTTP transport versions prior to 2.0.0
Bifrost 1.6.x line through 1.6.11 (does not contain the fix)
Dynamically linked builds (DYNAMIC=1) are exploitable for RCE; the published statically linked Docker image is limited to server-side request forgery (SSRF)

Discovery Timeline

2026-09-06 - CVE-2026-86242 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86242

Vulnerability Analysis

The vulnerability is a code injection flaw ([CWE-94]) in Bifrost's plugin management API. When management authentication is disabled, which is the default state, the POST /api/plugins endpoint accepts arbitrary plugin definitions from unauthenticated network clients. If the supplied plugin path begins with http:// or https://, the shared-object loader fetches the remote resource and writes it to a temporary .so file on disk.

Bifrost then invokes Go's plugin.Open against the downloaded file. On successful load, an optional Init function executes immediately with the attacker-supplied configuration, running as the Bifrost process user. This grants full code execution inside the gateway process.

Exploitation is constrained on statically linked builds. The published Docker image links statically, so plugin.Open returns Dynamic loading not supported, reducing impact to SSRF via the file download. However, the vendor documents that custom Go plugins require DYNAMIC=1 builds, and those deployments are fully exploitable.

Root Cause

The root cause is a missing authentication requirement combined with unsafe handling of remotely sourced plugin paths. The plugin loader trusts the caller-supplied path without validating its scheme, origin, or provenance. The default configuration governance.auth_config.is_enabled=false leaves the management API exposed to any network reachable client.

Attack Vector

An attacker with network access to the Bifrost HTTP transport sends an unauthenticated POST /api/plugins request that references an attacker-controlled URL hosting a malicious Go plugin shared object. The Bifrost process downloads the file, loads it with plugin.Open, and executes any exported Init function. Successful exploitation requires matching the target's Go version, operating system, CPU architecture, and dynamic linkage, which raises attack complexity but does not prevent exploitation of documented dynamic builds.

text

// Security patch in core/go.mod - path normalization auth bypass (#5763)
 	github.com/andybalholm/brotli v1.2.2
 	github.com/aws/aws-sdk-go-v2 v1.42.0
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10
-	github.com/aws/aws-sdk-go-v2/config v1.32.11
+	github.com/aws/aws-sdk-go-v2/config v1.32.14
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.14
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0
 	github.com/aws/aws-sdk-go-v2/service/sts v1.41.10
 	github.com/aws/smithy-go v1.27.1
 	github.com/bytedance/sonic v1.15.1

Source: Bifrost commit e0057ff

Detection Methods for CVE-2026-86242

Indicators of Compromise

Unauthenticated POST /api/plugins requests to Bifrost HTTP transport endpoints containing plugin definitions with http:// or https:// path values
Outbound HTTP or HTTPS requests originating from the Bifrost process to unfamiliar or attacker-controlled hosts, followed by creation of temporary .so files
New shared object files written to Bifrost temporary directories that were not deployed by administrators
Unexpected child processes, network sockets, or configuration changes attributable to the Bifrost process user

Detection Strategies

Alert on any POST to /api/plugins where the path field is an absolute URL rather than a local filesystem path
Correlate plugin.Open invocations in application logs with preceding outbound HTTP fetches to non-allowlisted hosts
Baseline the set of loaded Bifrost plugins and alert on additions that were not introduced through change management

Monitoring Recommendations

Forward Bifrost application and access logs to a centralized analytics platform for retention and correlation
Monitor egress traffic from AI gateway hosts for connections to public code hosting or ephemeral file-sharing services
Track filesystem writes to Bifrost working directories, focusing on .so extensions and executable file modes

How to Mitigate CVE-2026-86242

Immediate Actions Required

Upgrade the Bifrost HTTP transport to version 2.0.0 or later, which contains the fix
Enable management authentication by setting governance.auth_config.is_enabled=true and configuring credentials before exposing the transport to any network
Restrict network access to the /api/plugins endpoint using firewall rules, reverse proxy ACLs, or service mesh policies
Audit currently loaded plugins and review Bifrost logs for prior unauthenticated POST /api/plugins requests

Patch Information

The fix is available in Bifrost transports/v2.0.0. Details of the code changes are documented in pull request #5763 and commit e0057ff. Full advisory context is published as GHSA-2qp8-4xgm-fw6g. The 1.6.x line through 1.6.11 does not receive the fix and should be replaced with 2.0.0 or later.

Workarounds

Deploy only the statically linked Docker image, which prevents plugin.Open from succeeding and limits impact to SSRF
Enable management authentication and rotate credentials on any environment that previously ran with the default configuration
Block outbound HTTP and HTTPS from Bifrost hosts to any destination not required for legitimate model provider traffic

bash

# Configuration example: enable management authentication
governance:
  auth_config:
    is_enabled: true
    # Configure an authentication method per vendor documentation

# Network-level restriction (example iptables rule)
iptables -A INPUT -p tcp --dport 8080 -m string \
  --string "/api/plugins" --algo bm -j DROP