Vulnerability in Bifrost AI Gateway Affects Internal Service Security
CVE-2026-55245

8.7HIGH

Key Information:

Vendor

Maximhq

Status
Bifrost
Vendor
CVE Published:
28 August 2026

What is CVE-2026-55245?

The Bifrost AI gateway, used for routing requests to model providers, has a vulnerability arising from the isPublicIP function which incorrectly categorizes specific IP address ranges as public. These ranges include Carrier-Grade NAT and deprecated IPv6 addresses. This misclassification allows remote attackers to potentially exploit multimodal request URLs, retrieving internal services like cloud instance metadata. This issue was resolved in version 1.5.17 of the product.

Affected Version(s)

bifrost < 1.5.17

References

https://github.com/maximhq/bifrost/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/maximhq/bifrost/pull/4092
x_refsource_MISC
https://github.com/maximhq/bifrost/commit/54ec431fc5255ff...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.