CVE-2026-86242 Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds
Unauthenticated attackers can achieve remote code execution on dynamically linked Bifrost builds by uploading malicious plugins via HTTP paths when management authentication is disabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86242?
CVE-2026-86242 is a high-severity code injection vulnerability in maximhq Bifrost, published on 6 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go's plugin.Open. After a successful open, optional Init runs immediately with the supplied config as the Bifrost process user. On documented dynamically linked builds (DYNAMIC=1 / no static-link flags), which the vendor requires for custom Go plugins, plugin.Open is expected to succeed and this is unauthenticated remote code execution. On the published statically linked Docker image, plugin.Open fails with Dynamic loading not supported, so that build class is only server-side request forgery. Attack complexity is High because the attacker cannot force RCE on the default static image and a loadable plugin must match the host Go version, OS, architecture, and linkage. The 1.6.x HTTP transport line through 1.6.11 does not contain the fix.
Which versions are affected by CVE-2026-86242?
How do I fix CVE-2026-86242?
No fix has been published for CVE-2026-86242 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-86242 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-86242 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-2qp8-4xgm-fw6g, GHSA-7g8f-4jrf-x782.