Bifrost HTTP Plugin RCE (CVE-2026-86242): Affected Builds and Response

Why this vulnerability matters

CVE-2026-86242 affects the HTTP management surface in Bifrost, a gateway that connects applications to multiple AI model providers. The plugin API accepts a remote path, downloads a shared object to a temporary location, and opens it with Go’s plugin loader. When management authentication is disabled and the endpoint is reachable, an unauthenticated request can choose code that the Bifrost process will attempt to load.

The vendor rates the issue High at CVSS 3.1 8.1. Reliable code execution requires a dynamically linked build compatible with the attacker-supplied plugin’s operating system, architecture, Go version, and linkage. The documented static Docker image does not load the plugin, but the outbound download step still creates an SSRF path. Deployment type and management-plane exposure therefore matter as much as the package version.

Affected and fixed releases

Bifrost HTTP releases before 2.0.0 are affected. The advisory states that the 1.6 line through 1.6.11 has no fixed build; 2.0.0 is the fixed release. Treat the move from 1.x as a controlled upgrade that covers configuration, startup behavior, provider integrations, and custom plugin compatibility.

Attack path

An attacker reaches an instance whose management endpoint is exposed and authentication is disabled. A POST request to `/api/plugins` supplies a remote plugin location. Bifrost downloads the file, calls `plugin.Open`, and, when the build conditions match, invokes the plugin’s `Init` function with the service process privileges. Access control is the first and most important boundary because one management operation connects download, load, and initialization.

In a statically linked deployment, shared-object loading fails, but the server still performs an attacker-directed HTTP request. Review that path for access to internal services or cloud metadata endpoints. A failed code-loading condition should not be treated as a harmless event; determine where the chain stopped and preserve both proxy and process evidence.

Priority checks

• Identify the running version and whether the binary is dynamically or statically linked.
• Map management API exposure through load balancers, proxies, and firewall rules.
• Verify management authentication and rotate exposed administrative credentials.
• Review `/api/plugins` requests, remote URLs, temporary shared objects, and plugin initialization logs.
• Compare every installed plugin with an approved name, hash, and deployment-time baseline.

Remediation

Upgrade to Bifrost 2.0.0 or later. Reproduce provider configuration, authentication, custom plugins, observability, and startup behavior in staging before the production change. Back up configuration and secrets securely, define rollback criteria, then verify the actual management API and approved plugin initialization after deployment rather than relying on a displayed version alone.

During a short upgrade delay, remove public access to the management API and place it behind a trusted management network and authenticated proxy. Restrict plugin installation to designated operators and constrain remote download destinations. These controls reduce exposure but do not replace the fixed release.

Validation and recovery

Test the endpoint from internet, user-network, and management-network vantage points. Unauthorized networks should be blocked, and unauthenticated plugin changes should be rejected even on the approved route. Confirm approved plugins still load, and inspect logs to ensure the server no longer retrieves arbitrary shared objects. For static images, validate outbound controls for internal and metadata addresses.

If evidence of exploitation appears, isolate the instance and preserve plugin files, temporary directories, Bifrost logs, proxy logs, process details, and network activity. Rebuild from a clean 2.0.0 image and verified configuration. Scope rotation for administrative secrets and model-provider API keys according to the compromised process privileges. Completion means the fixed release, protected management plane, enforced authentication, plugin baseline, and monitoring are all verified.