CVE-2026-86242

Name of the Vulnerable Software and Affected Versions Bifrost HTTP transport versions prior to 2.0.0

Description An issue exists where the management API accepts custom plugins via an HTTP URL through the 'POST /api/plugins' endpoint when management authentication is disabled (default setting governance.auth config.is enabled=false). The shared-object loader downloads the remote object, writes it as a temporary .so file, and passes it to Go's plugin.Open function, which then executes the plugin's optional Init() function with the privileges of the Bifrost process user. On dynamically linked builds, this leads to unauthenticated remote code execution. On statically linked Docker images, the process results in server-side request forgery (SSRF), which is a vulnerability where the server is coerced into making unauthorized requests to internal or external resources. Successful remote code execution requires the plugin to match the host's Go version, operating system, CPU architecture, and linkage configuration.

Recommendations Update Bifrost HTTP transport to version 2.0.0 or later. Enable management authentication by setting governance.auth config.is enabled=true. Restrict network access to the 'POST /api/plugins' endpoint.