Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through the createPlugin and updatePlugin handlers. An attacker can load arbitrary native code into the gateway process by sending POST /api/plugins or PUT /api/plugins/name with a non-builtin path when dashboar...

CVE-2026-86242 Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled the default, governance.authconfig.isenabled=false. The shared-object loader treats an http-prefixed path as a downlo...

CVE-2026-86242

Bifrost HTTP transport (before 2.0.0) is vulnerable to unauthenticated remote code execution on dynamically linked builds. When management authentication is disabled (the default), an attacker can send a POST /api/plugins request with an HTTP URL as the plugin path. The shared-object loader downl...

CVE-2026-86242 Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled the default, governance.authconfig.isenabled=false. The shared-object loader treats an http-prefixed path as a downlo...

EUVD-2026-72104

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled the default, governance.authconfig.isenabled=false. The shared-object loader treats an http-prefixed path as a downlo...

CVE-2026-86242 Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled the default, governance.authconfig.isenabled=false. The shared-object loader treats an http-prefixed path as a downlo...

CVE-2026-86242: Improper Control of Generation of Code

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled the default, governance.authconfig.isenabled=false. The shared-object loader treats an http-prefixed path as a downlo...

PT-2026-86512

Name of the Vulnerable Software and Affected Versions Bifrost HTTP transport versions prior to 2.0.0 Description An issue exists where the management API accepts custom plugins via an HTTP URL through the 'POST /api/plugins' endpoint when management authentication is disabled default setting...

GO-2026-6320 Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL in github.com/maximhq/bifrost/core

Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL in github.com/maximhq/bifrost/core...

Bifrost SSRF

The vulnerability of the isPublicIP function in the core/providers/utils/fetch.go file of the data-free synchronization software Bifrost is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a remote attacker to execute an SSRF attack...

CVE-2026-55245

creationtimestamp| type| source ---|---|--- 2026-08-28 20:35:24+00:00| published-proof-of-concept| https://github.com/maximhq/bifrost/security/advisories/GHSA-w98g-5w9p-p3rc...

CVE-2026-55245

Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16,...

GHSA-W98G-5W9P-P3RC Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL

Summary isPublicIP in core/providers/utils/fetch.go — the SSRF deny-list that gates FetchAndEncodeURL — does not reject several routable address ranges that map onto internal infrastructure. Carrier-Grade NAT 100.64.0.0/10, RFC 6598, IPv6 6to4 2002::/16, NAT64 64:ff9b::/96 and 64:ff9b:1::/48, and...

Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL

Summary isPublicIP in core/providers/utils/fetch.go — the SSRF deny-list that gates FetchAndEncodeURL — does not reject several routable address ranges that map onto internal infrastructure. Carrier-Grade NAT 100.64.0.0/10, RFC 6598, IPv6 6to4 2002::/16, NAT64 64:ff9b::/96 and 64:ff9b:1::/48, and...

CVE-2026-55245

Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17 , the isPublicIP function in core/providers/utils/fetch.go (reached via FetchAndEncodeURL for Bedrock and Vertex image/document URLs) incorrectly classifies CGNAT (100.64.0.0/10) , IPv6 6to4 (2002::/16) ,...

CVE-2026-55245 Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL

Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16,...

CVE-2026-55245 Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL

Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16,...

EUVD-2026-67860

Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16,...

CVE-2026-55245 Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL

Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16,...

CVE-2026-55245

Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16,...