Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.
The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).
transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.
Management API reachable and governance.auth_config.is_enabled=false, which is the documented default. Confirmed on maximhq/bifrost v1.6.3. Fixed in transports/v2.1.0 (2026-09-08). An operator who enables management authentication and keeps the admin listener off untrusted networks is not exposed to the unauthenticated form of this issue.
JFrog has a private proof of concept. An unauthenticated POST /api/mcp/client with connection_type stdio and attacker-chosen command and args starts the program in the gateway. Public exploit details are not included in this record.
Set governance.auth_config.is_enabled to true, use strong administrator credentials, and firewall the management listener.
Upgrade Bifrost HTTP transport to 2.1.0 or later. PR #6757 returns 403 for unauthenticated stdio MCP client registration when dashboard authentication is disabled or unconfigured. Authenticated admins can still add stdio clients. The 1.6.x line through 1.6.11 and transports/v2.0.0 do not include this change.