What is CVE-2022-39219?

CVE-2022-39219 is a high-severity vulnerability in Brokercap Bifrost, classified under Improper Authentication. CVSS score: 8.5/10. Published 2022-09-26.

How severe is CVE-2022-39219?

High severity. CVSS v3 base score is 8.5 out of 10.

Auth bypass in Brokercap Bifrost

CVE-2022-39219

Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only have read permissions to write requests when they are normally forbidden from doing so. Version 1.8.7-release contains a patch. There are currently no known workarounds.

Vulnerability class: Broken Authentication

Published 2022-09-26 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L.

EPSS exploit prediction

EPSS: 0.012 (66.5th percentile), scored 2026-10-04.

Low probability of exploitation in the next 30 days, but still tracked. 66th percentile — 66.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.010 · newest: 0.012 · change: +0.002

Affected products

Brokercap Bifrost — versions < 1.8.7-release
Xbifrost Bifrost

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

github.com/brokercap/Bifrost/security/advisories/GHSA-p6fh-xc6r-g5hw (Third Party Advisory)
github.com/brokercap/Bifrost/issues/200 (Exploit, Third Party Advisory, Issue Tracking)
github.com/brokercap/Bifrost/releases/tag/v1.8.7-release (Third Party Advisory, Release Notes)

Frequently asked questions

What is CVE-2022-39219?: CVE-2022-39219 is a high-severity vulnerability in Brokercap Bifrost, classified under Improper Authentication. CVSS score: 8.5/10. Published 2022-09-26.
How severe is CVE-2022-39219?: High severity. CVSS v3 base score is 8.5 out of 10.