Answer in brief
CVE-2026-86242 records a High severity (CVSS 8.1) vulnerability in Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds. The current sources do not mark it as known exploited. The current feed maps maximhq/Bifrost (generic), maximhq/github.com/maximhq/bifrost/transports (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps maximhq/Bifrost (generic), maximhq/github.com/maximhq/bifrost/transports (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| maximhq/Bifrostgeneric | >=0 <2.0.0 | 2.0.0 |
| maximhq/github.com/maximhq/bifrost/transportsgeneric | >=0 <2.0.0 | 2.0.0 |
Published upstream
Sep 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 6, 2026
Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go's plugin.Open. After a successful open, optional Init runs immediately with the supplied config as the Bifrost process user. On documented dynamically linked builds (DYNAMIC=1 / no static-link flags), which the vendor requires for custom Go plugins, plugin.Open is expected to succeed and this is unauthenticated remote code execution. On the published statically linked Docker image, plugin.Open fails with Dynamic loading not supported, so that build class is only server-side request forgery. Attack complexity is High because the attacker cannot force RCE on the default static image and a loadable plugin must match the host Go version, OS, architecture, and linkage. The 1.6.x HTTP transport line through 1.6.11 does not contain the fix.
Quoted source text, attributed separately from HOL analysis.