Bifrost's management API registers MCP clients by starting specified programs immediately upon client addition without requiring an MCP handshake. The default configuration disables authentication (governance.auth_config.is_enabled=false), effectively granting local admin rights to any caller. An unauthenticated POST request to /api/mcp/client can execute arbitrary programs as the Bifrost process user (appuser in the official image). This issue affects all versions prior to 2.1.0. The vulnerability is addressed in transports/v2.1.0, which rejects unauthenticated stdio registrations with an HTTP 403 response.

An unauthenticated attacker can execute arbitrary code on the Bifrost gateway with the privileges of the Bifrost process user. This leads to full confidentiality, integrity, and availability compromise of the affected system. The default disabled authentication setting exacerbates the risk by granting local admin rights to any caller without credentials.

Upgrade to version 2.1.0 or later, which enforces authentication and rejects unauthenticated stdio client registrations with a 403 error. Until upgraded, enable authentication by setting governance.auth_config.is_enabled to true to prevent unauthorized access. No other mitigations are indicated in the advisory.