Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds (CVE-2026-86242) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-86242

Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds

Answer in brief

CVE-2026-86242 records a Unknown severity vulnerability in Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds. The current sources do not mark it as known exploited. The current feed maps maximhq/Bifrost (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 6, 2026Updated Sep 6, 2026Source checked Sep 6, 2026First seen by HOL Sep 6, 2026Material review Sep 6, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps maximhq/Bifrost (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
maximhq/Bifrostgeneric	>=0 <2.0.0	2.0.0

Recommended response

Check inventory. Check lockfiles and deployed manifests for maximhq/Bifrost.
Review the reported fix. Update maximhq/Bifrost to 2.0.0 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 6, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 6, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 6, 2026

Sources and claim methodology

Upstream source description

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go's plugin.Open. After a successful open, optional Init runs immediately with the supplied config as the Bifrost process user. On documented dynamically linked builds (DYNAMIC=1 / no static-link flags), which the vendor requires for custom Go plugins, plugin.Open is expected to succeed and this is unauthenticated remote code execution. On the published statically linked Docker image, plugin.Open fails with Dynamic loading not supported, so that build class is only server-side request forgery. Attack complexity is High because the attacker cannot force RCE on the default static image and a loadable plugin must match the host Go version, OS, architecture, and linkage. The 1.6.x HTTP transport line through 1.6.11 does not contain the fix.

Quoted source text, attributed separately from HOL analysis.