Maximhq Bifrost
3 CVEs affecting Maximhq Bifrost. Latest disclosed: 2026-09-14. Critical: 1, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-90898 | Critical | 9.8 | 2026-09-14 | Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the clie… |
CVE-2026-86242 | High | 8.1 | 2026-09-06 | Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authen… |
CVE-2026-55245 | | 2026-08-28 | Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached… |