CVE-2026-86242: Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-09-06 · updated 2026-09-09
Weakness: CWE-94

Description

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go's plugin.Open. After a successful open, optional Init runs immediately with the supplied config as the Bifrost process user. On documented dynamically linked builds (DYNAMIC=1 / no static-link flags), which the vendor requires for custom Go plugins, plugin.Open is expected to succeed and this is unauthenticated remote code execution. On the published statically linked Docker image, plugin.Open fails with Dynamic loading not supported, so that build class is only server-side request forgery. Attack complexity is High because the attacker cannot force RCE on the default static image and a loadable plugin must match the host Go version, OS, architecture, and linkage. The 1.6.x HTTP transport line through 1.6.11 does not contain the fix.

Affected products

maximhq Bifrost: before 2.0.0 — fixed in 2.0.0

How to fix

Upgrade to a fixed version: maximhq Bifrost 2.0.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-86242 or the next vulnerability affects your stack