Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by maximhq
CVE-2026-86242 (GCVE-0-2026-86242)
Vulnerability from nvd – Published: 2026-09-06 11:20 – Updated: 2026-09-06 11:20
VLAI
EPSS
VEX
Title
Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds
Summary
Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go's plugin.Open. After a successful open, optional Init runs immediately with the supplied config as the Bifrost process user. On documented dynamically linked builds (DYNAMIC=1 / no static-link flags), which the vendor requires for custom Go plugins, plugin.Open is expected to succeed and this is unauthenticated remote code execution. On the published statically linked Docker image, plugin.Open fails with Dynamic loading not supported, so that build class is only server-side request forgery. Attack complexity is High because the attacker cannot force RCE on the default static image and a loadable plugin must match the host Go version, OS, architecture, and linkage. The 1.6.x HTTP transport line through 1.6.11 does not contain the fix.
Severity
8.1 (High)
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/maximhq/bifrost/security/advis… | vendor-advisory |
| https://github.com/maximhq/bifrost/pull/5763 | patch |
| https://github.com/maximhq/bifrost/commit/e0057ff… | patch |
| https://github.com/maximhq/bifrost/releases/tag/t… | release-notes |
| https://github.com/maximhq/bifrost | product |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/maximhq/bifrost",
"defaultStatus": "unaffected",
"modules": [
"transports/bifrost-http",
"framework/plugins"
],
"packageName": "github.com/maximhq/bifrost/transports",
"platforms": [
"Linux",
"macOS"
],
"product": "Bifrost",
"programFiles": [
"transports/bifrost-http/handlers/plugins.go",
"transports/bifrost-http/handlers/middlewares.go",
"framework/plugins/soloader.go"
],
"repo": "git://github.com/maximhq/bifrost",
"vendor": "maximhq",
"versions": [
{
"changes": [
{
"at": "2.0.0-prerelease3",
"status": "unaffected"
}
],
"lessThan": "2.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffects dynamically linked Bifrost binaries that can load Go plugins (DYNAMIC=1), with the management API reachable and governance.auth_config.is_enabled=false (default at disclosure). Linux and macOS only (Go plugin package). The default statically linked Docker image is not RCE-capable; that build class is SSRF only. Confirmed on maximhq/bifrost v1.6.3 for the download-then-plugin.Open path. End-to-end malicious .so load against a DYNAMIC=1 binary was not completed in lab; the RCE score is for the documented custom-plugin build class where plugin.Open is expected to succeed.\u003c/p\u003e"
}
],
"value": "Affects dynamically linked Bifrost binaries that can load Go plugins (DYNAMIC=1), with the management API reachable and governance.auth_config.is_enabled=false (default at disclosure). Linux and macOS only (Go plugin package). The default statically linked Docker image is not RCE-capable; that build class is SSRF only. Confirmed on maximhq/bifrost v1.6.3 for the download-then-plugin.Open path. End-to-end malicious .so load against a DYNAMIC=1 binary was not completed in lab; the RCE score is for the documented custom-plugin build class where plugin.Open is expected to succeed."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Or Peles"
},
{
"lang": "en",
"type": "coordinator",
"value": "JFrog Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eBifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go\u0027s plugin.Open. After a successful open, optional Init runs immediately with the supplied config as the Bifrost process user. On documented dynamically linked builds (DYNAMIC=1 / no static-link flags), which the vendor requires for custom Go plugins, plugin.Open is expected to succeed and this is unauthenticated remote code execution. On the published statically linked Docker image, plugin.Open fails with Dynamic loading not supported, so that build class is only server-side request forgery. Attack complexity is High because the attacker cannot force RCE on the default static image and a loadable plugin must match the host Go version, OS, architecture, and linkage. The 1.6.x HTTP transport line through 1.6.11 does not contain the fix.\u003c/p\u003e"
}
],
"value": "Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go\u0027s plugin.Open. After a successful open, optional Init runs immediately with the supplied config as the Bifrost process user. On documented dynamically linked builds (DYNAMIC=1 / no static-link flags), which the vendor requires for custom Go plugins, plugin.Open is expected to succeed and this is unauthenticated remote code execution. On the published statically linked Docker image, plugin.Open fails with Dynamic loading not supported, so that build class is only server-side request forgery. Attack complexity is High because the attacker cannot force RCE on the default static image and a loadable plugin must match the host Go version, OS, architecture, and linkage. The 1.6.x HTTP transport line through 1.6.11 does not contain the fix."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA proof of concept issues an unauthenticated POST /api/plugins with enabled=true and path set to an HTTP URL of a Go shared object built for the target Go version and linkage. On a dynamically linked Bifrost binary the loader downloads the body and plugin.Open runs Init in-process (for example writing a marker file as the gateway user). On the official static image the same request downloads the file and then fails with Dynamic loading not supported.\u003c/p\u003e"
}
],
"value": "A proof of concept issues an unauthenticated POST /api/plugins with enabled=true and path set to an HTTP URL of a Go shared object built for the target Go version and linkage. On a dynamically linked Bifrost binary the loader downloads the body and plugin.Open runs Init in-process (for example writing a marker file as the gateway user). On the official static image the same request downloads the file and then fails with Dynamic loading not supported."
}
],
"impacts": [
{
"capecId": "CAPEC-253",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-253 Remote Code Inclusion"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-06T11:20:11.759Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "GHSA-2qp8-4xgm-fw6g",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/maximhq/bifrost/security/advisories/GHSA-2qp8-4xgm-fw6g"
},
{
"name": "PR #5763: require authenticated admin for custom plugin path; harden plugin download SSRF",
"tags": [
"patch"
],
"url": "https://github.com/maximhq/bifrost/pull/5763"
},
{
"name": "Merge commit for PR #5763",
"tags": [
"patch"
],
"url": "https://github.com/maximhq/bifrost/commit/e0057ff355f831c251eabe9d0e44f3a3748532c6"
},
{
"name": "Bifrost HTTP v2.0.0 (first stable release containing the fix)",
"tags": [
"release-notes"
],
"url": "https://github.com/maximhq/bifrost/releases/tag/transports/v2.0.0"
},
{
"name": "Bifrost repository",
"tags": [
"product"
],
"url": "https://github.com/maximhq/bifrost"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade Bifrost HTTP transport to 2.0.0 or later. The fix (PR #5763) refuses create and update of a non-builtin plugin path when the request was let through because dashboard authentication is disabled or unconfigured (403), and replaces the plugin downloader with an SSRF-hardened client. The 1.6.x line through 1.6.11 does not include this change.\u003c/p\u003e"
}
],
"value": "Upgrade Bifrost HTTP transport to 2.0.0 or later. The fix (PR #5763) refuses create and update of a non-builtin plugin path when the request was let through because dashboard authentication is disabled or unconfigured (403), and replaces the plugin downloader with an SSRF-hardened client. The 1.6.x line through 1.6.11 does not include this change."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-19T10:02:00.000Z",
"value": "Reported to the Bifrost maintainers (GHSA-2qp8-4xgm-fw6g)"
},
{
"lang": "en",
"time": "2026-08-03T04:50:00.000Z",
"value": "Fix merged upstream (PR #5763)"
},
{
"lang": "en",
"time": "2026-08-13T18:51:00.000Z",
"value": "Fix first present on the v2 line in transports/v2.0.0-prerelease3"
},
{
"lang": "en",
"time": "2026-08-26T19:47:00.000Z",
"value": "Fix first shipped in a stable release (Bifrost HTTP v2.0.0)"
}
],
"title": "Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIf custom Go plugins are not required, run the statically linked binary or official Docker image so plugin.Open cannot succeed. Otherwise enable dashboard authentication and keep the management listener off untrusted networks.\u003c/p\u003e"
}
],
"value": "If custom Go plugins are not required, run the statically linked binary or official Docker image so plugin.Open cannot succeed. Otherwise enable dashboard authentication and keep the management listener off untrusted networks."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-86242",
"datePublished": "2026-09-06T11:20:11.759Z",
"dateReserved": "2026-09-06T09:15:54.440Z",
"dateUpdated": "2026-09-06T11:20:11.759Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55245 (GCVE-0-2026-55245)
Vulnerability from nvd – Published: 2026-08-28 18:24 – Updated: 2026-08-28 19:54
VLAI
EPSS
VEX
Title
Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL
Summary
Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16, NAT64 64:ff9b::/96 and 64:ff9b:1::/48, and deprecated IPv6 site-local fec0::/10 addresses as public. A remote attacker who controls a multimodal request URL can make the gateway fetch internal services, including a cloud instance metadata endpoint encoded through 6to4 or NAT64. This issue is fixed in version 1.5.17.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 19:54 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/maximhq/bifrost/security/advis… | x_refsource_CONFIRM |
| https://github.com/maximhq/bifrost/pull/4092 | x_refsource_MISC |
| https://github.com/maximhq/bifrost/commit/54ec431… | x_refsource_MISC |
| https://github.com/maximhq/bifrost/releases/tag/c… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55245",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T19:54:05.268770Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T19:54:10.966Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/maximhq/bifrost/security/advisories/GHSA-w98g-5w9p-p3rc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "bifrost",
"vendor": "maximhq",
"versions": [
{
"status": "affected",
"version": "\u003c 1.5.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16, NAT64 64:ff9b::/96 and 64:ff9b:1::/48, and deprecated IPv6 site-local fec0::/10 addresses as public. A remote attacker who controls a multimodal request URL can make the gateway fetch internal services, including a cloud instance metadata endpoint encoded through 6to4 or NAT64. This issue is fixed in version 1.5.17."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T18:24:16.723Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/maximhq/bifrost/security/advisories/GHSA-w98g-5w9p-p3rc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/maximhq/bifrost/security/advisories/GHSA-w98g-5w9p-p3rc"
},
{
"name": "https://github.com/maximhq/bifrost/pull/4092",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maximhq/bifrost/pull/4092"
},
{
"name": "https://github.com/maximhq/bifrost/commit/54ec431fc5255ff42c36420d88549477e0b33d89",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maximhq/bifrost/commit/54ec431fc5255ff42c36420d88549477e0b33d89"
},
{
"name": "https://github.com/maximhq/bifrost/releases/tag/core/v1.5.17",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maximhq/bifrost/releases/tag/core/v1.5.17"
}
],
"source": {
"advisory": "GHSA-w98g-5w9p-p3rc",
"discovery": "UNKNOWN"
},
"title": "Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55245",
"datePublished": "2026-08-28T18:24:16.723Z",
"dateReserved": "2026-06-16T16:44:00.624Z",
"dateUpdated": "2026-08-28T19:54:10.966Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86242 (GCVE-0-2026-86242)
Vulnerability from cvelistv5 – Published: 2026-09-06 11:20 – Updated: 2026-09-06 11:20
VLAI
EPSS
VEX
Title
Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds
Summary
Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go's plugin.Open. After a successful open, optional Init runs immediately with the supplied config as the Bifrost process user. On documented dynamically linked builds (DYNAMIC=1 / no static-link flags), which the vendor requires for custom Go plugins, plugin.Open is expected to succeed and this is unauthenticated remote code execution. On the published statically linked Docker image, plugin.Open fails with Dynamic loading not supported, so that build class is only server-side request forgery. Attack complexity is High because the attacker cannot force RCE on the default static image and a loadable plugin must match the host Go version, OS, architecture, and linkage. The 1.6.x HTTP transport line through 1.6.11 does not contain the fix.
Severity
8.1 (High)
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/maximhq/bifrost/security/advis… | vendor-advisory |
| https://github.com/maximhq/bifrost/pull/5763 | patch |
| https://github.com/maximhq/bifrost/commit/e0057ff… | patch |
| https://github.com/maximhq/bifrost/releases/tag/t… | release-notes |
| https://github.com/maximhq/bifrost | product |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/maximhq/bifrost",
"defaultStatus": "unaffected",
"modules": [
"transports/bifrost-http",
"framework/plugins"
],
"packageName": "github.com/maximhq/bifrost/transports",
"platforms": [
"Linux",
"macOS"
],
"product": "Bifrost",
"programFiles": [
"transports/bifrost-http/handlers/plugins.go",
"transports/bifrost-http/handlers/middlewares.go",
"framework/plugins/soloader.go"
],
"repo": "git://github.com/maximhq/bifrost",
"vendor": "maximhq",
"versions": [
{
"changes": [
{
"at": "2.0.0-prerelease3",
"status": "unaffected"
}
],
"lessThan": "2.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffects dynamically linked Bifrost binaries that can load Go plugins (DYNAMIC=1), with the management API reachable and governance.auth_config.is_enabled=false (default at disclosure). Linux and macOS only (Go plugin package). The default statically linked Docker image is not RCE-capable; that build class is SSRF only. Confirmed on maximhq/bifrost v1.6.3 for the download-then-plugin.Open path. End-to-end malicious .so load against a DYNAMIC=1 binary was not completed in lab; the RCE score is for the documented custom-plugin build class where plugin.Open is expected to succeed.\u003c/p\u003e"
}
],
"value": "Affects dynamically linked Bifrost binaries that can load Go plugins (DYNAMIC=1), with the management API reachable and governance.auth_config.is_enabled=false (default at disclosure). Linux and macOS only (Go plugin package). The default statically linked Docker image is not RCE-capable; that build class is SSRF only. Confirmed on maximhq/bifrost v1.6.3 for the download-then-plugin.Open path. End-to-end malicious .so load against a DYNAMIC=1 binary was not completed in lab; the RCE score is for the documented custom-plugin build class where plugin.Open is expected to succeed."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Or Peles"
},
{
"lang": "en",
"type": "coordinator",
"value": "JFrog Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eBifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go\u0027s plugin.Open. After a successful open, optional Init runs immediately with the supplied config as the Bifrost process user. On documented dynamically linked builds (DYNAMIC=1 / no static-link flags), which the vendor requires for custom Go plugins, plugin.Open is expected to succeed and this is unauthenticated remote code execution. On the published statically linked Docker image, plugin.Open fails with Dynamic loading not supported, so that build class is only server-side request forgery. Attack complexity is High because the attacker cannot force RCE on the default static image and a loadable plugin must match the host Go version, OS, architecture, and linkage. The 1.6.x HTTP transport line through 1.6.11 does not contain the fix.\u003c/p\u003e"
}
],
"value": "Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go\u0027s plugin.Open. After a successful open, optional Init runs immediately with the supplied config as the Bifrost process user. On documented dynamically linked builds (DYNAMIC=1 / no static-link flags), which the vendor requires for custom Go plugins, plugin.Open is expected to succeed and this is unauthenticated remote code execution. On the published statically linked Docker image, plugin.Open fails with Dynamic loading not supported, so that build class is only server-side request forgery. Attack complexity is High because the attacker cannot force RCE on the default static image and a loadable plugin must match the host Go version, OS, architecture, and linkage. The 1.6.x HTTP transport line through 1.6.11 does not contain the fix."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA proof of concept issues an unauthenticated POST /api/plugins with enabled=true and path set to an HTTP URL of a Go shared object built for the target Go version and linkage. On a dynamically linked Bifrost binary the loader downloads the body and plugin.Open runs Init in-process (for example writing a marker file as the gateway user). On the official static image the same request downloads the file and then fails with Dynamic loading not supported.\u003c/p\u003e"
}
],
"value": "A proof of concept issues an unauthenticated POST /api/plugins with enabled=true and path set to an HTTP URL of a Go shared object built for the target Go version and linkage. On a dynamically linked Bifrost binary the loader downloads the body and plugin.Open runs Init in-process (for example writing a marker file as the gateway user). On the official static image the same request downloads the file and then fails with Dynamic loading not supported."
}
],
"impacts": [
{
"capecId": "CAPEC-253",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-253 Remote Code Inclusion"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-06T11:20:11.759Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "GHSA-2qp8-4xgm-fw6g",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/maximhq/bifrost/security/advisories/GHSA-2qp8-4xgm-fw6g"
},
{
"name": "PR #5763: require authenticated admin for custom plugin path; harden plugin download SSRF",
"tags": [
"patch"
],
"url": "https://github.com/maximhq/bifrost/pull/5763"
},
{
"name": "Merge commit for PR #5763",
"tags": [
"patch"
],
"url": "https://github.com/maximhq/bifrost/commit/e0057ff355f831c251eabe9d0e44f3a3748532c6"
},
{
"name": "Bifrost HTTP v2.0.0 (first stable release containing the fix)",
"tags": [
"release-notes"
],
"url": "https://github.com/maximhq/bifrost/releases/tag/transports/v2.0.0"
},
{
"name": "Bifrost repository",
"tags": [
"product"
],
"url": "https://github.com/maximhq/bifrost"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade Bifrost HTTP transport to 2.0.0 or later. The fix (PR #5763) refuses create and update of a non-builtin plugin path when the request was let through because dashboard authentication is disabled or unconfigured (403), and replaces the plugin downloader with an SSRF-hardened client. The 1.6.x line through 1.6.11 does not include this change.\u003c/p\u003e"
}
],
"value": "Upgrade Bifrost HTTP transport to 2.0.0 or later. The fix (PR #5763) refuses create and update of a non-builtin plugin path when the request was let through because dashboard authentication is disabled or unconfigured (403), and replaces the plugin downloader with an SSRF-hardened client. The 1.6.x line through 1.6.11 does not include this change."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-19T10:02:00.000Z",
"value": "Reported to the Bifrost maintainers (GHSA-2qp8-4xgm-fw6g)"
},
{
"lang": "en",
"time": "2026-08-03T04:50:00.000Z",
"value": "Fix merged upstream (PR #5763)"
},
{
"lang": "en",
"time": "2026-08-13T18:51:00.000Z",
"value": "Fix first present on the v2 line in transports/v2.0.0-prerelease3"
},
{
"lang": "en",
"time": "2026-08-26T19:47:00.000Z",
"value": "Fix first shipped in a stable release (Bifrost HTTP v2.0.0)"
}
],
"title": "Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIf custom Go plugins are not required, run the statically linked binary or official Docker image so plugin.Open cannot succeed. Otherwise enable dashboard authentication and keep the management listener off untrusted networks.\u003c/p\u003e"
}
],
"value": "If custom Go plugins are not required, run the statically linked binary or official Docker image so plugin.Open cannot succeed. Otherwise enable dashboard authentication and keep the management listener off untrusted networks."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-86242",
"datePublished": "2026-09-06T11:20:11.759Z",
"dateReserved": "2026-09-06T09:15:54.440Z",
"dateUpdated": "2026-09-06T11:20:11.759Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55245 (GCVE-0-2026-55245)
Vulnerability from cvelistv5 – Published: 2026-08-28 18:24 – Updated: 2026-08-28 19:54
VLAI
EPSS
VEX
Title
Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL
Summary
Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16, NAT64 64:ff9b::/96 and 64:ff9b:1::/48, and deprecated IPv6 site-local fec0::/10 addresses as public. A remote attacker who controls a multimodal request URL can make the gateway fetch internal services, including a cloud instance metadata endpoint encoded through 6to4 or NAT64. This issue is fixed in version 1.5.17.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 19:54 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/maximhq/bifrost/security/advis… | x_refsource_CONFIRM |
| https://github.com/maximhq/bifrost/pull/4092 | x_refsource_MISC |
| https://github.com/maximhq/bifrost/commit/54ec431… | x_refsource_MISC |
| https://github.com/maximhq/bifrost/releases/tag/c… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55245",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T19:54:05.268770Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T19:54:10.966Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/maximhq/bifrost/security/advisories/GHSA-w98g-5w9p-p3rc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "bifrost",
"vendor": "maximhq",
"versions": [
{
"status": "affected",
"version": "\u003c 1.5.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16, NAT64 64:ff9b::/96 and 64:ff9b:1::/48, and deprecated IPv6 site-local fec0::/10 addresses as public. A remote attacker who controls a multimodal request URL can make the gateway fetch internal services, including a cloud instance metadata endpoint encoded through 6to4 or NAT64. This issue is fixed in version 1.5.17."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T18:24:16.723Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/maximhq/bifrost/security/advisories/GHSA-w98g-5w9p-p3rc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/maximhq/bifrost/security/advisories/GHSA-w98g-5w9p-p3rc"
},
{
"name": "https://github.com/maximhq/bifrost/pull/4092",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maximhq/bifrost/pull/4092"
},
{
"name": "https://github.com/maximhq/bifrost/commit/54ec431fc5255ff42c36420d88549477e0b33d89",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maximhq/bifrost/commit/54ec431fc5255ff42c36420d88549477e0b33d89"
},
{
"name": "https://github.com/maximhq/bifrost/releases/tag/core/v1.5.17",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maximhq/bifrost/releases/tag/core/v1.5.17"
}
],
"source": {
"advisory": "GHSA-w98g-5w9p-p3rc",
"discovery": "UNKNOWN"
},
"title": "Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55245",
"datePublished": "2026-08-28T18:24:16.723Z",
"dateReserved": "2026-06-16T16:44:00.624Z",
"dateUpdated": "2026-08-28T19:54:10.966Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}