{"vulnerability": "cve-2026-90898", "sightings": [{"uuid": "94432a7c-3409-441e-9a8e-7b499143b850", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90898", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvhxwzsz522f", "content": "CVE-2026-90898 - bifrost\nAnyone can send a simple request to Bifrost and cause it to start any command on the gateway machine. In versions that still use the older API endpoint, this can be done without any\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#bifrost #maximhq #CVE #infosec", "creation_timestamp": "2026-09-14T11:10:06.993471Z"}, {"uuid": "a6137e38-4602-4e3c-9ee4-a1ca58cf73e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90898", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvi35ifopn2j", "content": "\ud83d\udea8 CVE-2026-90898 \u2014 CVSS 9.8 CRITICAL\n\nBifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost st...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-90898\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-14T12:07:24.961449Z"}, {"uuid": "8dac3572-c0d3-4c38-8366-563989a40641", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90898", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6iqsxiympabzh", "content": "CVE-2026-90898 - Bifrost unauthenticated remote code execution via MCP stdio client registration\nCVE ID : CVE-2026-90898\n \n Published : Sept. 14, 2026, 11:17 a.m. | 36\u00a0minutes ago\n \n Description : Bifrost registers MCP clients through its management API. A stdio client is a co...", "creation_timestamp": "2026-09-14T12:27:21.520235Z"}]}