CVE-2026-55245
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Bifrost before version 1.5.17 incorrectly classifies addresses from CGNAT, 6to4, NAT64, and fec0::/10 ranges as public. An attacker controlling a multimodal request URL can make the gateway fetch internal services, including cloud instance metadata.
Risk Assessment
Access to internal services and theft of credentials or other sensitive information from cloud metadata is possible.
Recommendation
Update Bifrost to version 1.5.17 which contains the fix.
Other vulnerabilities in Bifrost
See all- CVE-2026-90898Critical
Bifrost registers MCP clients through its management API, where a stdio client is a command plus args that is started immediately upon client addition, with no MCP handshake required. Authentication is disabled by default (governance.auth_config.is_enabled=false), meaning every caller is treated as a local admin. A single unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).
- CVE-2026-86840Critical
The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement.
- CVE-2026-86242High
Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled. The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to plugin.Open. On dynamically linked builds this is unauthenticated remote code execution; on the static Docker image it is only SSRF.
Original NVD description (English source)
Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16, NAT64 64:ff9b::/96 and 64:ff9b:1::/48, and deprecated IPv6 site-local fec0::/10 addresses as public. A remote attacker who controls a multimodal request URL can make the gateway fetch internal services, including a cloud instance metadata endpoint encoded through 6to4 or NAT64. This issue is fixed in version 1.5.17.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS