Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials

Both critical vulnerabilities in the Bifrost AI gateway stem from a single root failure: authentication is disabled by default on the management API, meaning any attacker with network access can execute arbitrary commands without credentials. This 'secure by default' failure is a foundational misconfiguration that should never reach production, let alone be the default state of an internet-facing gateway. The secondary flaw compounding the risk allows untrusted HTTP URLs to register custom plugins, creating additional command execution and SSRF attack surfaces. As AI gateway adoption accelerates, insecure default configurations in these components represent an emerging and high-impact attack vector across enterprises. Organizations deploying open-source AI infrastructure must treat hardening defaults as a mandatory deployment prerequisite, not an optional step.