CVE-2026-86242

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go's plugin.Open. After a successful open, optional Init runs immediately with the supplied config as the Bifrost process user. On documented dynamically linked builds (DYNAMIC=1 / no static-link flags), which the vendor requires for custom Go plugins, plugin.Open is expected to succeed and this is unauthenticated remote code execution. On the published statically linked Docker image, plugin.Open fails with Dynamic loading not supported, so that build class is only server-side request forgery. Attack complexity is High because the attacker cannot force RCE on the default static image and a loadable plugin must match the host Go version, OS, architecture, and linkage. The 1.6.x HTTP transport line through 1.6.11 does not contain the fix.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/maximhq/bifrost
https://github.com/maximhq/bifrost/commit/e0057ff355f831c251eabe9d0e44f3a3748532c6
https://github.com/maximhq/bifrost/pull/5763
https://github.com/maximhq/bifrost/releases/tag/transports/v2.0.0
https://github.com/maximhq/bifrost/security/advisories/GHSA-2qp8-4xgm-fw6g

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-06 12:17

Updated : 2026-09-09 15:44

NVD link : CVE-2026-86242

Mitre link : CVE-2026-86242

CVE.ORG link : CVE-2026-86242

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-284

Improper Access Control

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-86242", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-86242", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-08T18:23:19.631126Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "reefs@jfrog.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "reefs@jfrog.com", "affectedData": [{"repo": "git://github.com/maximhq/bifrost", "vendor": "maximhq", "modules": ["transports/bifrost-http", "framework/plugins"], "product": "Bifrost", "versions": [{"status": "affected", "changes": [{"at": "2.0.0-prerelease3", "status": "unaffected"}], "version": "0", "lessThan": "2.0.0", "versionType": "semver"}], "platforms": ["Linux", "macOS"], "packageName": "github.com/maximhq/bifrost/transports", "programFiles": ["transports/bifrost-http/handlers/plugins.go", "transports/bifrost-http/handlers/middlewares.go", "framework/plugins/soloader.go"], "collectionURL": "https://github.com/maximhq/bifrost", "defaultStatus": "unaffected"}]}], "published": "2026-09-06T12:17:15.583", "references": [{"url": "https://github.com/maximhq/bifrost", "source": "reefs@jfrog.com"}, {"url": "https://github.com/maximhq/bifrost/commit/e0057ff355f831c251eabe9d0e44f3a3748532c6", "source": "reefs@jfrog.com"}, {"url": "https://github.com/maximhq/bifrost/pull/5763", "source": "reefs@jfrog.com"}, {"url": "https://github.com/maximhq/bifrost/releases/tag/transports/v2.0.0", "source": "reefs@jfrog.com"}, {"url": "https://github.com/maximhq/bifrost/security/advisories/GHSA-2qp8-4xgm-fw6g", "source": "reefs@jfrog.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "reefs@jfrog.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go's plugin.Open. After a successful open, optional Init runs immediately with the supplied config as the Bifrost process user. On documented dynamically linked builds (DYNAMIC=1 / no static-link flags), which the vendor requires for custom Go plugins, plugin.Open is expected to succeed and this is unauthenticated remote code execution. On the published statically linked Docker image, plugin.Open fails with Dynamic loading not supported, so that build class is only server-side request forgery. Attack complexity is High because the attacker cannot force RCE on the default static image and a loadable plugin must match the host Go version, OS, architecture, and linkage. The 1.6.x HTTP transport line through 1.6.11 does not contain the fix."}], "lastModified": "2026-09-09T15:44:01.133", "sourceIdentifier": "reefs@jfrog.com"}