Critical Bifrost AI Gateway Flaw Allowed Unauthenticated Remote Code Execution

·2 views

A critical vulnerability (CVE-2026-90898, CVSS 9.8) in the Bifrost open-source AI gateway allowed attackers to execute arbitrary commands with a single unauthenticated HTTP POST request to its MCP management API. Discovered by Yuval Moravchick at JFrog Security Research, the flaw stemmed from management authentication being disabled by default and the official Docker image binding the API to 0.0.0.0, making it publicly reachable. Exploiting the stdio transport type, an attacker could register a malicious MCP client that caused Bifrost to spawn any specified shell command as its own process user. This exposed environment variables containing API keys for all configured LLM providers, including OpenAI, Anthropic, and Google. The issue has been patched in transports/v2.1.0, and users running versions 2.0.x or 1.6.x are urged to update immediately.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Sticky Session Routing Without TTLs Quietly Causes Backend Imbalance

Session affinity routes clients to the same backend node consistently, but problems arise when assignment records are never deleted after a client disconnects or goes idle. Over time, stale rows accumulate in the routing table, causing the load-balancing logic to misjudge which nodes are least loaded. This gradually concentrates traffic on a small number of nodes, producing imbalance that appears unrelated to any routing bug. The recommended fix is adding a TTL to each assignment, refreshed on every active use, rather than relying on explicit delete-on-disconnect events that may never fire. Developers using DynamoDB should note that its native TTL deletion is best-effort and not instantaneous, so expired records may briefly persist beyond their expiry time.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Connect Shopify to GA4 Without Google Tag Manager Using Native Events

Shopify's Google & YouTube sales channel can send the full GA4 ecommerce event set natively in minutes, eliminating the need for Google Tag Manager. However, browser-side data loss from ad blockers, iOS tracking prevention, and ITP can cause GA4 purchase counts to fall short of actual Shopify orders. To close this gap, developers recommend adding a server-side purchase event that sends data to GA4 via the Measurement Protocol through a Shopify webhook. Setting up the integration requires creating a GA4 property with matching timezone and currency, then connecting it through the Shopify Google & YouTube channel using the same Google account that owns the property. Additional best practices include extending data retention to 14 months on day one and enabling Enhanced Measurement, since the default two-month retention window prevents year-over-year analysis.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer shares free SKILL.md template to turn AI into a Python coding mentor

A self-taught developer has created and open-sourced a SKILL.md template designed to configure AI tools like ChatGPT, Claude, and Lumo AI into structured Python tutors rather than answer machines. The template is grounded in established educational concepts, including scaffolded hints, Zone of Proximal Development, and a three-tier concept breakdown covering analogies, syntax, and internal Python mechanics. It also introduces the L.I.F.T. code review framework, which evaluates code on Logic, Idiomatic Pythonness, PEP 8 formatting, and time-space complexity. The approach aims to address a gap for self-taught developers who cannot afford bootcamps or CS degrees and currently rely on AI tools that bypass active problem-solving. The template is compatible with multiple AI platforms and local agents, and the author has shared it on DEV Community to gather feedback for further improvement.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SQL Subqueries and CTEs Explained With Real-World Data Analysis Examples

SQL subqueries and Common Table Expressions (CTEs) are techniques that help analysts break complex data questions into smaller, manageable steps. A subquery, also called a nested or inner query, is written inside another SQL query and passes its result to the outer query for further processing. For instance, finding employees who earn above the company average requires first calculating that average, which a subquery can handle automatically within a single statement. This approach is especially useful with dynamic data, as the query recalculates results each time it runs rather than relying on hardcoded values. The article further classifies subqueries by the number of values they return and how they interact with outer queries, alongside a comparison with CTEs.

0 comments Read more at DEV Community