Bifrost LLM gateway: unauthenticated plugin API loads a remote shared object, giving RCE on dynamic builds

Impact

Bifrost's management HTTP transport accepts a custom plugin whose path is an http:// URL over POST /api/plugins, and management authentication is off by default (governance.auth_config.is_enabled=false). The loader downloads the URL body to a temporary .so, hands it to Go's plugin.Open, and then runs the plugin's optional Init as the Bifrost process user, so on the dynamically linked builds the vendor requires for custom Go plugins this is unauthenticated remote code execution inside the gateway. A gateway is a high-value target on a GPU fleet: it holds upstream provider API keys and sees every tenant prompt and response routed through it, so code execution there is credential theft plus traffic interception rather than one workload compromised. On the published statically linked Docker image plugin.Open fails with "Dynamic loading not supported", which reduces that build class to server-side request forgery from the gateway's network position - still useful for reaching internal endpoints the caller cannot address directly. Exploitation of the RCE path needs a plugin built to match the host Go version, OS, architecture and linkage, which is why the record rates attack complexity high.

Who can reach it

Anyone who can reach the Bifrost HTTP transport's management API. No authentication is required in the default configuration; if governance auth has been enabled, a caller must be authorized to it.

What to do

Upgrade the HTTP transport to v2.0.0 and restart the gateway process; the 1.6.x line through 1.6.11 does not carry the fix. Where an upgrade cannot happen immediately, set governance.auth_config.is_enabled=true and keep the management API off any tenant-reachable or shared network. Operators running the published statically linked Docker image are exposed to SSRF rather than RCE, but should still restrict and upgrade. This is a service restart, not a node drain - inference in flight through the gateway will drop.

References

Related entries

• ClearML client SDK: Deserialization of untrusted dataCVE-2024-24590 · ClearML client SDKHigh
• ClearML client SDK: Path traversal — a malicious dataset writes arbitrary files on the consumerCVE-2024-24591 · ClearML client SDKHigh
• Keras (`utils.get_file`): Path traversal in tar extraction in 3.11.3 (incomplete fix)CVE-2025-12638 · Keras (`utils.get_file`)High
• vLLM (multi-node ZeroMQ): Secondary vLLM host trusts unauthenticated ZeroMQ messagesCVE-2025-30165 · vLLM (multi-node ZeroMQ)High
• Kubeflow Community Distribution: Insecure default in the platform installCVE-2026-47237 · Kubeflow Community DistributionHigh
• PyTorch (mobile interpreter): Use-after-free in `torch/csrc/jit/mobile/interpreter.cpp`CVE-2024-31583 · PyTorch (mobile interpreter)High