What’s Vulnerable › Vulnerabilities

CVE-2022-39267: Brokercap Bifrost vulnerable to authentication bypass for admin and monitor user groups

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-19 · updated 2026-06-17
• Weakness: CWE-287

Description

Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for production environments. Versions prior to 1.8.8-release are subject to authentication bypass in the admin and monitor user groups by deleting the X-Requested-With: XMLHttpRequest field in the request header. This issue has been patched in 1.8.8-release. There are no known workarounds.

Affected products

• brokercap Bifrost: through 1.8.6

References

• https://github.com/brockercap/Bifrost/pull/201
• https://github.com/brokercap/Bifrost/security/advisories/GHSA-mxrx-fg8p-5p5j
• https://github.com/brockercap/Bifrost/pull/201
• https://github.com/brokercap/Bifrost/security/advisories/GHSA-mxrx-fg8p-5p5j

Get alerted when CVE-2022-39267 or the next vulnerability affects your stack