{"id":"CVE-2026-86242","summary":"Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds","details":"Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go's plugin.Open. After a successful open, optional Init runs immediately with the supplied config as the Bifrost process user. On documented dynamically linked builds (DYNAMIC=1 / no static-link flags), which the vendor requires for custom Go plugins, plugin.Open is expected to succeed and this is unauthenticated remote code execution. On the published statically linked Docker image, plugin.Open fails with Dynamic loading not supported, so that build class is only server-side request forgery. Attack complexity is High because the attacker cannot force RCE on the default static image and a loadable plugin must match the host Go version, OS, architecture, and linkage. The 1.6.x HTTP transport line through 1.6.11 does not contain the fix.","aliases":["GHSA-2qp8-4xgm-fw6g"],"modified":"2026-09-10T03:31:03.474723393Z","published":"2026-09-06T11:20:11.759Z","database_specific":{"cwe_ids":["CWE-284","CWE-306","CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86242.json","cna_assigner":"JFROG"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86242.json"},{"type":"ADVISORY","url":"https://github.com/maximhq/bifrost/releases/tag/transports/v2.0.0"},{"type":"ADVISORY","url":"https://github.com/maximhq/bifrost/security/advisories/GHSA-2qp8-4xgm-fw6g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86242"},{"type":"FIX","url":"https://github.com/maximhq/bifrost/commit/e0057ff355f831c251eabe9d0e44f3a3748532c6"},{"type":"FIX","url":"https://github.com/maximhq/bifrost/pull/5763"},{"type":"PACKAGE","url":"git://github.com/maximhq/bifrost"},{"type":"PACKAGE","url":"https://github.com/maximhq/bifrost"}],"affected":[{"ranges":[{"type":"GIT","repo":"git://github.com/maximhq/bifrost","events":[{"introduced":"0"},{"fixed":"e4a30d6041c0446603aea615bc5da340dac001b1"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.0.0"}],"source":"AFFECTED_FIELD"}},{"type":"GIT","repo":"https://github.com/maximhq/bifrost","events":[{"introduced":"0"},{"fixed":"e4a30d6041c0446603aea615bc5da340dac001b1"},{"fixed":"0a8a38c983b7b932a3f7b4e85adeac08ad99b497"},{"fixed":"e0057ff355f831c251eabe9d0e44f3a3748532c6"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.0.0"},{"fixed":"1.6.11"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["plugins/routing/v1.0.0","plugins/telemetry/v1.6.0","plugins/semanticcache/v1.6.0","plugins/prompts/v1.1.0","plugins/otel/v1.5.0","plugins/modelcatalogresolver/v1.1.0","plugins/mocker/v1.6.0","plugins/maxim/v1.7.0","plugins/logging/v1.7.0","plugins/jsonparser/v1.6.0","plugins/governance/v1.7.0","plugins/compat/v0.2.0","framework/v1.6.0","core/v1.8.3","core/v1.8.2","core/v1.8.1","core/v1.8.0","ent-v1.5.12-base","core/v1.7.13","transports/v1.6.11","ent-v1.5.11-base","plugins/telemetry/v1.5.37","plugins/semanticcache/v1.5.37","plugins/prompts/v1.0.37","plugins/otel/v1.4.9","plugins/modelcatalogresolver/v1.0.18","plugins/mocker/v1.5.37","plugins/maxim/v1.6.37","plugins/logging/v1.6.10","plugins/jsonparser/v1.5.37","plugins/governance/v1.6.14","plugins/compat/v0.1.36","framework/v1.5.10","core/v1.7.10","ent-v1.5.10-base","transports/v1.6.10","plugins/telemetry/v1.5.35","plugins/semanticcache/v1.5.35","plugins/prompts/v1.0.35","plugins/otel/v1.4.7","plugins/modelcatalogresolver/v1.0.16","plugins/mocker/v1.5.35","plugins/maxim/v1.6.35","plugins/logging/v1.6.8","plugins/jsonparser/v1.5.35","plugins/governance/v1.6.12","plugins/compat/v0.1.34","framework/v1.5.8","core/v1.7.9","core/v1.7.8","ent-v1.5.9-base","transports/v1.6.9","plugins/telemetry/v1.5.34","plugins/semanticcache/v1.5.34","plugins/prompts/v1.0.34","plugins/otel/v1.4.6","plugins/modelcatalogresolver/v1.0.15","plugins/mocker/v1.5.34","plugins/maxim/v1.6.34","plugins/logging/v1.6.7","plugins/jsonparser/v1.5.34","plugins/governance/v1.6.11","plugins/compat/v0.1.33","framework/v1.5.7","core/v1.7.7","transports/v1.6.8","ent-v1.5.8-base","helm-chart-v2.1.34","plugins/telemetry/v1.5.33","plugins/semanticcache/v1.5.33","plugins/prompts/v1.0.33","plugins/otel/v1.4.5","plugins/modelcatalogresolver/v1.0.14","plugins/mocker/v1.5.33","plugins/maxim/v1.6.33","plugins/logging/v1.6.6","plugins/jsonparser/v1.5.33","plugins/governance/v1.6.10","plugins/compat/v0.1.32","framework/v1.5.6","core/v1.7.6","helm-chart-v2.1.33","helm-chart-v2.1.32","ent-v1.5.7-base","transports/v1.6.7","plugins/telemetry/v1.5.32","plugins/semanticcache/v1.5.32","plugins/prompts/v1.0.32","plugins/otel/v1.4.4","plugins/modelcatalogresolver/v1.0.13","plugins/mocker/v1.5.32","plugins/maxim/v1.6.32","plugins/logging/v1.6.5","plugins/jsonparser/v1.5.32","plugins/governance/v1.6.9","plugins/compat/v0.1.31","framework/v1.5.5","core/v1.7.5","ent-v1.5.6-base","transports/v1.6.6","core/v1.7.4","plugins/telemetry/v1.5.31","plugins/semanticcache/v1.5.31","plugins/prompts/v1.0.31","plugins/otel/v1.4.3","plugins/modelcatalogresolver/v1.0.12","plugins/mocker/v1.5.31","plugins/maxim/v1.6.31","plugins/logging/v1.6.4","plugins/jsonparser/v1.5.31","plugins/governance/v1.6.8","plugins/compat/v0.1.30","framework/v1.5.4","helm-chart-v2.1.31","ent-v1.5.5-base","transports/v1.6.5","plugins/telemetry/v1.5.30","plugins/semanticcache/v1.5.30","plugins/prompts/v1.0.30","plugins/otel/v1.4.2","plugins/modelcatalogresolver/v1.0.11","plugins/mocker/v1.5.30","plugins/maxim/v1.6.30","plugins/logging/v1.6.3","plugins/jsonparser/v1.5.30","plugins/governance/v1.6.7","plugins/compat/v0.1.29","framework/v1.5.3","core/v1.7.3","helm-chart-v2.1.30","helm-chart-v2.1.29","helm-chart-v2.1.28","transports/v1.6.4","ent-v1.5.4-base","plugins/otel/v1.4.0","plugins/telemetry/v1.5.28","plugins/semanticcache/v1.5.28","plugins/prompts/v1.0.28","plugins/modelcatalogresolver/v1.0.9","plugins/mocker/v1.5.28","plugins/maxim/v1.6.28","plugins/logging/v1.6.1","plugins/jsonparser/v1.5.28","plugins/governance/v1.6.5","plugins/compat/v0.1.27","framework/v1.5.1","core/v1.7.1","plugins/logging/v1.5.27","framework/v1.4.4","core/v1.6.4","helm-chart-v2.1.27","ent-v1.5.3-base","transports/v1.6.3","plugins/telemetry/v1.5.26","plugins/semanticcache/v1.5.26","plugins/prompts/v1.0.26","plugins/otel/v1.3.3","plugins/modelcatalogresolver/v1.0.7","plugins/mocker/v1.5.26","plugins/maxim/v1.6.26","plugins/logging/v1.5.26","plugins/jsonparser/v1.5.26","plugins/governance/v1.6.3","plugins/compat/v0.1.25","framework/v1.4.3","helm-chart-v2.1.26","core/v1.6.3","ent-v1.5.2-base","transports/v1.6.2","plugins/telemetry/v1.5.25","plugins/semanticcache/v1.5.25","plugins/prompts/v1.0.25","plugins/otel/v1.3.2","plugins/modelcatalogresolver/v1.0.6","plugins/mocker/v1.5.25","plugins/maxim/v1.6.25","plugins/logging/v1.5.25","plugins/jsonparser/v1.5.25","plugins/governance/v1.6.2","plugins/compat/v0.1.24","framework/v1.4.2","core/v1.6.2","ent-v1.5.1-base","transports/v1.6.1","plugins/telemetry/v1.5.24","plugins/semanticcache/v1.5.24","plugins/prompts/v1.0.24","plugins/otel/v1.3.1","plugins/modelcatalogresolver/v1.0.5","plugins/mocker/v1.5.24","plugins/maxim/v1.6.24","plugins/logging/v1.5.24","plugins/jsonparser/v1.5.24","plugins/governance/v1.6.1","plugins/compat/v0.1.23","framework/v1.4.1","core/v1.6.1","helm-chart-v2.1.25","ent-v1.5.0-base","transports/v1.6.0","plugins/telemetry/v1.5.23","plugins/semanticcache/v1.5.23","plugins/prompts/v1.0.23","plugins/otel/v1.3.0","plugins/modelcatalogresolver/v1.0.4","plugins/mocker/v1.5.23","plugins/maxim/v1.6.23","plugins/logging/v1.5.23","plugins/jsonparser/v1.5.23","plugins/governance/v1.6.0","plugins/compat/v0.1.22","framework/v1.4.0","core/v1.6.0","ent-v1.4.13-base","transports/v1.5.16","plugins/telemetry/v1.5.22","plugins/semanticcache/v1.5.22","plugins/prompts/v1.0.22","plugins/otel/v1.2.23","plugins/modelcatalogresolver/v1.0.3","plugins/mocker/v1.5.22","plugins/maxim/v1.6.22","plugins/logging/v1.5.22","plugins/jsonparser/v1.5.22","plugins/governance/v1.5.22","plugins/compat/v0.1.21","framework/v1.3.22","core/v1.5.22","bifrost-migration-cli/v0.1.0","cli/v0.10.6","ent-v1.4.11-base","transports/v1.5.15","plugins/telemetry/v1.5.21","plugins/semanticcache/v1.5.21","plugins/prompts/v1.0.21","plugins/otel/v1.2.22","plugins/modelcatalogresolver/v1.0.2","plugins/mocker/v1.5.21","plugins/maxim/v1.6.21","plugins/logging/v1.5.21","plugins/jsonparser/v1.5.21","plugins/governance/v1.5.21","plugins/compat/v0.1.20","framework/v1.3.21","core/v1.5.21","ent-v1.4.10-base","transports/v1.5.14","plugins/otel/v1.2.21","plugins/telemetry/v1.5.20","plugins/semanticcache/v1.5.20","plugins/prompts/v1.0.20","plugins/otel/v1.2.20","plugins/modelcatalogresolver/v1.0.1","plugins/mocker/v1.5.20","plugins/maxim/v1.6.20","plugins/logging/v1.5.20","plugins/jsonparser/v1.5.20","plugins/governance/v1.5.20","plugins/compat/v0.1.19","framework/v1.3.20","core/v1.5.20","transports/v1.5.13","ent-v1.4.9-base","transports/v1.5.12","plugins/semanticcache/v1.5.19","plugins/telemetry/v1.5.19","plugins/prompts/v1.0.19","plugins/otel/v1.2.19","plugins/modelcatalogresolver/v1.0.0","plugins/mocker/v1.5.19","plugins/maxim/v1.6.19","plugins/logging/v1.5.19","plugins/jsonparser/v1.5.19","plugins/governance/v1.5.19","plugins/compat/v0.1.18","framework/v1.3.19","core/v1.5.19","transports/v1.5.11","ent-v1.4.7-base","transports/v1.5.10","plugins/telemetry/v1.5.18","plugins/semanticcache/v1.5.18","plugins/prompts/v1.0.18","plugins/otel/v1.2.18","plugins/mocker/v1.5.18","plugins/maxim/v1.6.18","plugins/logging/v1.5.18","plugins/jsonparser/v1.5.18","plugins/governance/v1.5.18","plugins/compat/v0.1.17","framework/v1.3.18","core/v1.5.18","transports/v1.5.9","plugins/telemetry/v1.5.17","plugins/semanticcache/v1.5.17","plugins/prompts/v1.0.17","plugins/otel/v1.2.17","plugins/mocker/v1.5.17","plugins/maxim/v1.6.17","plugins/logging/v1.5.17","plugins/jsonparser/v1.5.17","plugins/governance/v1.5.17","plugins/compat/v0.1.16","framework/v1.3.17","core/v1.5.17","ent-v1.4.7-rc1-base","transports/v1.5.8","plugins/telemetry/v1.5.16","plugins/semanticcache/v1.5.16","plugins/prompts/v1.0.16","plugins/otel/v1.2.16","plugins/mocker/v1.5.16","plugins/maxim/v1.6.16","plugins/logging/v1.5.16","plugins/jsonparser/v1.5.16","plugins/governance/v1.5.16","plugins/compat/v0.1.15","framework/v1.3.16","core/v1.5.16","ent-v1.4.6-bedrock-fix-base","ent-v1.4.6-datasheet-fix-base","cli/v0.10.5","transports/v1.5.7","plugins/telemetry/v1.5.15","plugins/semanticcache/v1.5.15","plugins/prompts/v1.0.15","plugins/otel/v1.2.15","plugins/mocker/v1.5.15","plugins/maxim/v1.6.15","plugins/logging/v1.5.15","plugins/jsonparser/v1.5.15","plugins/governance/v1.5.15","plugins/compat/v0.1.14","framework/v1.3.15","core/v1.5.15","ent-v1.4.5-base","transports/v1.5.6","plugins/telemetry/v1.5.14","plugins/semanticcache/v1.5.14","plugins/prompts/v1.0.14","plugins/otel/v1.2.14","plugins/mocker/v1.5.14","plugins/maxim/v1.6.14","plugins/logging/v1.5.14","plugins/jsonparser/v1.5.14","plugins/governance/v1.5.14","plugins/compat/v0.1.13","framework/v1.3.14","core/v1.5.14","ent-v1.4.4-base","transports/v1.5.5","plugins/telemetry/v1.5.13","plugins/semanticcache/v1.5.13","plugins/prompts/v1.0.13","plugins/otel/v1.2.13","plugins/mocker/v1.5.13","plugins/maxim/v1.6.13","plugins/logging/v1.5.13","plugins/jsonparser/v1.5.13","plugins/governance/v1.5.13","plugins/compat/v0.1.12","framework/v1.3.13","core/v1.5.13","transports/v1.5.4","plugins/telemetry/v1.5.12","plugins/semanticcache/v1.5.12","plugins/prompts/v1.0.12","plugins/otel/v1.2.12","plugins/mocker/v1.5.12","plugins/maxim/v1.6.12","plugins/logging/v1.5.12","plugins/jsonparser/v1.5.12","plugins/governance/v1.5.12","plugins/compat/v0.1.11","framework/v1.3.12","core/v1.5.12","transports/v1.5.3","plugins/telemetry/v1.5.11","plugins/semanticcache/v1.5.11","plugins/prompts/v1.0.11","plugins/otel/v1.2.11","plugins/mocker/v1.5.11","plugins/maxim/v1.6.11","plugins/logging/v1.5.11","plugins/jsonparser/v1.5.11","plugins/governance/v1.5.11","plugins/compat/v0.1.10","framework/v1.3.11","npx/bifrost/v1.6.3","core/v1.5.11","cli/v0.10.4","transports/v1.5.2","plugins/telemetry/v1.5.10","plugins/semanticcache/v1.5.10","plugins/prompts/v1.0.10","plugins/otel/v1.2.10","plugins/mocker/v1.5.10","plugins/maxim/v1.6.10","plugins/logging/v1.5.10","plugins/jsonparser/v1.5.10","plugins/governance/v1.5.10","plugins/compat/v0.1.9","framework/v1.3.10","core/v1.5.10","ent-v1.4.1-base","transports/v1.5.1","plugins/telemetry/v1.5.9","plugins/semanticcache/v1.5.9","plugins/prompts/v1.0.9","plugins/otel/v1.2.9","plugins/mocker/v1.5.9","plugins/maxim/v1.6.9","plugins/logging/v1.5.9","plugins/jsonparser/v1.5.9","plugins/governance/v1.5.9","plugins/compat/v0.1.8","framework/v1.3.9","core/v1.5.9","helm-chart-v2.1.15","helm-chart-v2.1.14","ent-v1.4.0-base","transports/v1.5.0","plugins/telemetry/v1.5.8","plugins/semanticcache/v1.5.8","plugins/prompts/v1.0.8","plugins/otel/v1.2.8","plugins/mocker/v1.5.8","plugins/maxim/v1.6.8","plugins/logging/v1.5.8","plugins/jsonparser/v1.5.8","plugins/governance/v1.5.8","plugins/compat/v0.1.7","framework/v1.3.8","core/v1.5.8","helm-chart-v2.1.13","ent-v1.4.0-prerelease7-base","transports/v1.5.0-prerelease8","plugins/telemetry/v1.5.7","plugins/semanticcache/v1.5.7","plugins/prompts/v1.0.7","plugins/otel/v1.2.7","plugins/mocker/v1.5.7","plugins/maxim/v1.6.7","plugins/logging/v1.5.7","plugins/jsonparser/v1.5.7","plugins/governance/v1.5.7","plugins/compat/v0.1.6","framework/v1.3.7","core/v1.5.7","helm-chart-v2.1.12","helm-chart-v2.1.11","helm-chart-v2.1.10","ent-v1.4.0-prerelease6-stream-pause-base","ent-v1.4.0-prerelease6-base","transports/v1.5.0-prerelease7","plugins/telemetry/v1.5.6","plugins/semanticcache/v1.5.6","plugins/prompts/v1.0.6","plugins/otel/v1.2.6","plugins/mocker/v1.5.6","plugins/maxim/v1.6.6","plugins/logging/v1.5.6","plugins/jsonparser/v1.5.6","plugins/governance/v1.5.6","plugins/compat/v0.1.5","framework/v1.3.6","core/v1.5.6","helm-chart-v2.1.9","helm-chart-v2.1.8","ent-v1.4.0-prerelease5-base","transports/v1.5.0-prerelease6","helm-chart-v2.1.7","plugins/telemetry/v1.5.5","plugins/semanticcache/v1.5.5","plugins/prompts/v1.0.5","plugins/otel/v1.2.5","plugins/mocker/v1.5.5","plugins/maxim/v1.6.5","plugins/logging/v1.5.5","plugins/jsonparser/v1.5.5","plugins/governance/v1.5.5","plugins/compat/v0.1.4","framework/v1.3.5","core/v1.5.5","helm-chart-v2.1.6","helm-chart-v2.1.5","helm-chart-v2.1.4","transports/v1.5.0-prerelease5","plugins/telemetry/v1.5.4","plugins/semanticcache/v1.5.4","plugins/prompts/v1.0.4","plugins/otel/v1.2.4","plugins/mocker/v1.5.4","plugins/maxim/v1.6.4","plugins/logging/v1.5.4","plugins/jsonparser/v1.5.4","plugins/governance/v1.5.4","plugins/compat/v0.1.3","framework/v1.3.4","core/v1.5.4","ent-v1.4.0-prerelease4-base","transports/v1.5.0-prerelease4","plugins/semanticcache/v1.5.3","plugins/telemetry/v1.5.3","plugins/prompts/v1.0.3","plugins/otel/v1.2.3","plugins/mocker/v1.5.3","plugins/maxim/v1.6.3","plugins/logging/v1.5.3","plugins/jsonparser/v1.5.3","plugins/governance/v1.5.3","plugins/compat/v0.1.2","framework/v1.3.3","core/v1.5.3","ent-v1.3.19-base","transports/v1.4.23","plugins/telemetry/v1.4.39","plugins/semanticcache/v1.4.37","plugins/otel/v1.1.38","plugins/mocker/v1.4.38","plugins/maxim/v1.5.39","plugins/logging/v1.4.39","plugins/litellmcompat/v0.0.28","plugins/jsonparser/v1.4.38","plugins/governance/v1.4.39","framework/v1.2.39","core/v1.4.22","core/v1.4.21","core/v1.4.20","helm-chart-v2.1.1","helm-chart-v2.1.0-prerelease2","helm-chart-v2.1.0-prerelease1","helm-chart-v2.0.18-rc.1","helm-chart-v2.0.18","ent-v1.3.18-base","transports/v1.4.22","plugins/telemetry/v1.4.38","plugins/semanticcache/v1.4.36","plugins/otel/v1.1.37","plugins/mocker/v1.4.37","plugins/maxim/v1.5.38","plugins/logging/v1.4.38","plugins/litellmcompat/v0.0.27","plugins/jsonparser/v1.4.37","plugins/governance/v1.4.38","framework/v1.2.38","core/v1.4.19","transports/v1.4.21","plugins/telemetry/v1.4.37","plugins/semanticcache/v1.4.35","plugins/otel/v1.1.36","plugins/mocker/v1.4.36","plugins/maxim/v1.5.37","plugins/logging/v1.4.37","plugins/litellmcompat/v0.0.26","plugins/jsonparser/v1.4.36","plugins/governance/v1.4.37","framework/v1.2.37","core/v1.4.18","helm-chart-v2.0.15","ent-v1.3.17-base","helm-chart-v2.0.17","helm-chart-v2.0.16","transports/v1.4.20","plugins/telemetry/v1.4.36","plugins/semanticcache/v1.4.34","plugins/otel/v1.1.35","plugins/mocker/v1.4.35","plugins/maxim/v1.5.36","plugins/logging/v1.4.36","plugins/litellmcompat/v0.0.25","plugins/jsonparser/v1.4.35","plugins/governance/v1.4.36","framework/v1.2.36","core/v1.4.17","plugins/maxim/v1.5.35","ent-v1.3.16-base","transports/v1.4.19","plugins/telemetry/v1.4.35","plugins/semanticcache/v1.4.33","plugins/otel/v1.1.34","plugins/mocker/v1.4.34","plugins/maxim/v1.5.34","plugins/logging/v1.4.35","plugins/litellmcompat/v0.0.24","plugins/jsonparser/v1.4.34","plugins/governance/v1.4.35","framework/v1.2.35","core/v1.4.16","ent-v1.3.15-base","transports/v1.4.18","plugins/telemetry/v1.4.34","plugins/semanticcache/v1.4.32","plugins/otel/v1.1.33","plugins/mocker/v1.4.33","plugins/maxim/v1.5.33","plugins/logging/v1.4.34","plugins/litellmcompat/v0.0.23","plugins/jsonparser/v1.4.33","plugins/governance/v1.4.34","framework/v1.2.34","core/v1.4.15","ent-v1.3.14-base","cli/v0.10.3","framework/v1.2.33","ent-v1.3.13-base","transports/v1.4.17","core/v1.4.14","plugins/telemetry/v1.4.33","plugins/semanticcache/v1.4.31","plugins/otel/v1.1.32","plugins/mocker/v1.4.32","plugins/maxim/v1.5.32","plugins/logging/v1.4.33","plugins/litellmcompat/v0.0.22","plugins/jsonparser/v1.4.32","plugins/governance/v1.4.33","plugins/maxim/v1.5.31","ent-v1.3.12-base","transports/v1.4.16","plugins/telemetry/v1.4.32","plugins/semanticcache/v1.4.30","plugins/otel/v1.1.31","plugins/mocker/v1.4.31","plugins/maxim/v1.5.30","plugins/logging/v1.4.32","plugins/litellmcompat/v0.0.21","plugins/jsonparser/v1.4.31","plugins/governance/v1.4.32","framework/v1.2.32","core/v1.4.13","ent-v1.3.11-base","transports/v1.4.15","plugins/telemetry/v1.4.31","plugins/semanticcache/v1.4.29","plugins/otel/v1.1.30","plugins/mocker/v1.4.30","plugins/maxim/v1.5.29","plugins/logging/v1.4.31","plugins/litellmcompat/v0.0.20","plugins/jsonparser/v1.4.30","plugins/governance/v1.4.31","framework/v1.2.31","core/v1.4.12","helm-chart-v2.0.14","ent-v1.3.10-base","transports/v1.4.14","plugins/telemetry/v1.4.30","plugins/semanticcache/v1.4.28","plugins/otel/v1.1.29","plugins/mocker/v1.4.29","plugins/maxim/v1.5.28","plugins/logging/v1.4.30","plugins/litellmcompat/v0.0.19","plugins/jsonparser/v1.4.29","plugins/governance/v1.4.30","framework/v1.2.30","core/v1.4.11","transports/v1.4.13","plugins/telemetry/v1.4.29","plugins/semanticcache/v1.4.27","plugins/otel/v1.1.28","plugins/mocker/v1.4.28","plugins/maxim/v1.5.27","plugins/logging/v1.4.29","plugins/litellmcompat/v0.0.18","plugins/jsonparser/v1.4.28","plugins/governance/v1.4.29","framework/v1.2.29","core/v1.4.10","framework/v1.2.28","core/v1.4.9","ent-v1.3.9-base","transports/v1.4.12","plugins/telemetry/v1.4.28","plugins/semanticcache/v1.4.26","plugins/otel/v1.1.27","plugins/mocker/v1.4.27","plugins/maxim/v1.5.26","plugins/logging/v1.4.28","plugins/litellmcompat/v0.0.17","plugins/jsonparser/v1.4.27","plugins/governance/v1.4.28","framework/v1.2.27","core/v1.4.8","cli/v0.10.2","cli/v0.10.1","cli/v0.10.0","npx/bifrost/v1.6.2","npx/bifrost-cli/v1.0.1","helm-chart-v2.0.13","cli/v0.9.1","ent-v1.3.8-base","helm-chart-v2.0.12","plugins/logging/v1.4.27","transports/v1.4.11","plugins/telemetry/v1.4.27","plugins/semanticcache/v1.4.25","plugins/otel/v1.1.26","plugins/mocker/v1.4.26","plugins/maxim/v1.5.25","plugins/logging/v1.4.26","plugins/litellmcompat/v0.0.16","plugins/jsonparser/v1.4.26","plugins/governance/v1.4.27","framework/v1.2.26","core/v1.4.7","helm-chart-v2.0.11","helm-chart-v2.0.10","ent-v1.3.7-base","transports/v1.4.10","plugins/telemetry/v1.4.26","plugins/semanticcache/v1.4.24","plugins/otel/v1.1.25","plugins/mocker/v1.4.25","plugins/maxim/v1.5.24","plugins/logging/v1.4.25","plugins/litellmcompat/v0.0.15","plugins/jsonparser/v1.4.25","plugins/governance/v1.4.26","framework/v1.2.25","core/v1.4.6","plugins/telemetry/v1.4.25","plugins/semanticcache/v1.4.23","plugins/otel/v1.1.24","plugins/mocker/v1.4.24","plugins/maxim/v1.5.23","plugins/litellmcompat/v0.0.14","plugins/jsonparser/v1.4.24","plugins/governance/v1.4.25","framework/v1.2.24","core/v1.4.5","plugins/logging/v1.4.24","ent-v1.3.6-base","transports/v1.4.9","plugins/telemetry/v1.4.24","plugins/semanticcache/v1.4.22","plugins/otel/v1.1.23","plugins/mocker/v1.4.23","plugins/maxim/v1.5.22","plugins/logging/v1.4.23","plugins/litellmcompat/v0.0.13","plugins/jsonparser/v1.4.23","plugins/governance/v1.4.24","framework/v1.2.23","transports/v1.4.8","plugins/telemetry/v1.4.23","plugins/semanticcache/v1.4.21","plugins/otel/v1.1.22","plugins/mocker/v1.4.22","plugins/maxim/v1.5.21","plugins/logging/v1.4.22","plugins/litellmcompat/v0.0.12","plugins/jsonparser/v1.4.22","plugins/governance/v1.4.23","framework/v1.2.22","core/v1.4.4","helm-chart-v2.0.8","transports/v1.4.7","plugins/telemetry/v1.4.22","plugins/semanticcache/v1.4.20","plugins/otel/v1.1.21","plugins/mocker/v1.4.21","plugins/maxim/v1.5.20","plugins/logging/v1.4.21","plugins/litellmcompat/v0.0.11","plugins/jsonparser/v1.4.21","plugins/governance/v1.4.22","framework/v1.2.21","core/v1.4.3","helm-chart-v2.0.7","terraform/v0.1.0","ent-v1.3.5-base","transports/v1.4.6","plugins/otel/v1.1.20","plugins/telemetry/v1.4.21","plugins/semanticcache/v1.4.19","plugins/otel/v2.0.1","plugins/mocker/v1.4.20","plugins/maxim/v1.5.19","plugins/logging/v1.4.20","plugins/litellmcompat/v0.0.10","plugins/jsonparser/v1.4.20","plugins/governance/v1.4.21","framework/v1.2.20","core/v1.4.2","transports/v1.4.5","plugins/telemetry/v1.4.20","plugins/semanticcache/v1.4.18","plugins/otel/v1.1.19","plugins/mocker/v1.4.19","plugins/maxim/v1.5.18","plugins/logging/v1.4.19","plugins/litellmcompat/v0.0.9","plugins/jsonparser/v1.4.19","plugins/governance/v1.4.20","framework/v1.2.19","core/v1.4.1","helm-chart-v2.0.4","helm-chart-v2.0.3","transports/v1.4.4","plugins/telemetry/v1.4.19","plugins/semanticcache/v1.4.17","plugins/otel/v1.1.18","plugins/mocker/v1.4.18","plugins/maxim/v1.5.17","plugins/logging/v1.4.18","plugins/litellmcompat/v0.0.8","plugins/jsonparser/v1.4.18","plugins/governance/v1.4.19","framework/v1.2.18","plugins/semanticcache/v1.4.16","plugins/telemetry/v1.4.18","plugins/otel/v1.1.17","plugins/mocker/v1.4.17","plugins/maxim/v1.5.16","plugins/logging/v1.4.17","plugins/litellmcompat/v0.0.7","plugins/jsonparser/v1.4.17","plugins/governance/v1.4.18","framework/v1.2.17","core/v1.4.0","helm-chart-v2.0.2","helm-chart-v2.0.1","helm-chart-v2.0.0","helm-chart-v1.7.0","transports/v1.4.3","plugins/semanticcache/v1.4.15","plugins/telemetry/v1.4.17","plugins/otel/v1.1.16","plugins/mocker/v1.4.16","plugins/maxim/v1.5.15","plugins/logging/v1.4.16","plugins/litellmcompat/v0.0.6","plugins/jsonparser/v1.4.16","plugins/governance/v1.4.17","framework/v1.2.16","core/v1.3.14","plugins/telemetry/v1.4.16","plugins/otel/v1.1.15","plugins/mocker/v1.4.15","plugins/maxim/v1.5.14","plugins/logging/v1.4.15","plugins/litellmcompat/v0.0.5","plugins/jsonparser/v1.4.15","plugins/governance/v1.4.16","framework/v1.2.15","core/v1.3.13","helm-chart-v1.6.0","helm-chart-v1.5.3","framework/v1.2.14","transports/v1.4.2","plugins/telemetry/v1.4.15","plugins/semanticcache/v1.4.14","plugins/otel/v1.1.14","plugins/mocker/v1.4.14","plugins/maxim/v1.5.13","plugins/logging/v1.4.14","plugins/litellmcompat/v0.0.4","plugins/jsonparser/v1.4.14","plugins/governance/v1.4.15","plugins/telemetry/v1.4.14","plugins/semanticcache/v1.4.13","plugins/otel/v1.1.13","plugins/mocker/v1.4.13","plugins/maxim/v1.5.12","plugins/logging/v1.4.13","plugins/litellmcompat/v0.0.3","plugins/jsonparser/v1.4.13","plugins/governance/v1.4.14","framework/v1.2.13","core/v1.3.12","transports/v1.4.1","plugins/telemetry/v1.4.13","plugins/semanticcache/v1.4.12","plugins/otel/v1.1.12","plugins/mocker/v1.4.12","plugins/maxim/v1.5.11","plugins/logging/v1.4.12","plugins/litellmcompat/v0.0.2","plugins/jsonparser/v1.4.12","plugins/governance/v1.4.13","framework/v1.2.12","core/v1.3.11","transports/v1.4.0","plugins/governance/v1.4.12","plugins/telemetry/v1.4.12","plugins/semanticcache/v1.4.11","plugins/otel/v1.1.11","plugins/mocker/v1.4.11","plugins/maxim/v1.5.10","plugins/logging/v1.4.11","plugins/litellmcompat/v0.0.1","plugins/jsonparser/v1.4.11","framework/v1.2.11","core/v1.3.10","transports/v1.4.0-prerelease10","plugins/telemetry/v1.4.11","plugins/semanticcache/v1.4.10","plugins/otel/v1.1.10","plugins/mocker/v1.4.10","plugins/logging/v1.4.10","plugins/jsonparser/v1.4.10","plugins/governance/v1.4.11","framework/v1.2.10","plugins/semanticcache/v1.4.9","plugins/governance/v1.4.10","plugins/telemetry/v1.4.10","plugins/otel/v1.1.9","plugins/mocker/v1.4.9","plugins/maxim/v1.5.9","plugins/logging/v1.4.9","plugins/jsonparser/v1.4.9","framework/v1.2.9","core/v1.3.9","transports/v1.3.63","plugins/telemetry/v1.3.61","plugins/semanticcache/v1.3.61","plugins/otel/v1.0.61","plugins/mocker/v1.3.60","plugins/maxim/v1.4.63","plugins/logging/v1.3.62","plugins/jsonparser/v1.3.62","plugins/governance/v1.3.62","framework/v1.1.61","core/v1.2.49","transports/v1.3.61","plugins/telemetry/v1.3.60","plugins/semanticcache/v1.3.60","plugins/otel/v1.0.60","plugins/mocker/v1.3.59","plugins/maxim/v1.4.62","plugins/logging/v1.3.61","plugins/jsonparser/v1.3.61","plugins/governance/v1.3.61","framework/v1.1.60","core/v1.2.48","transports/v1.3.60","plugins/telemetry/v1.3.59","plugins/semanticcache/v1.3.59","plugins/otel/v1.0.59","plugins/maxim/v1.4.61","plugins/logging/v1.3.60","plugins/jsonparser/v1.3.60","plugins/governance/v1.3.60","framework/v1.1.59","helm-chart-v1.5.2","transports/v1.3.59","plugins/telemetry/v1.3.58","plugins/semanticcache/v1.3.58","plugins/otel/v1.0.58","plugins/mocker/v1.3.58","plugins/maxim/v1.4.60","plugins/logging/v1.3.59","plugins/jsonparser/v1.3.59","plugins/governance/v1.3.59","framework/v1.1.58","core/v1.2.47","transports/v1.3.58","plugins/telemetry/v1.3.57","plugins/semanticcache/v1.3.57","plugins/otel/v1.0.57","plugins/mocker/v1.3.57","plugins/maxim/v1.4.59","plugins/logging/v1.3.58","plugins/jsonparser/v1.3.58","plugins/governance/v1.3.58","framework/v1.1.57","core/v1.2.46","plugins/maxim/v1.4.58","transports/v1.3.57","plugins/telemetry/v1.3.56","plugins/semanticcache/v1.3.56","plugins/otel/v1.0.56","plugins/mocker/v1.3.56","plugins/maxim/v1.4.57","plugins/logging/v1.3.57","plugins/jsonparser/v1.3.57","plugins/governance/v1.3.57","framework/v1.1.56","transports/v1.3.56","plugins/telemetry/v1.3.55","plugins/semanticcache/v1.3.55","plugins/otel/v1.0.55","plugins/mocker/v1.3.55","plugins/maxim/v1.4.56","plugins/logging/v1.3.56","plugins/jsonparser/v1.3.56","plugins/governance/v1.3.56","framework/v1.1.55","core/v1.2.45","transports/v1.3.55","plugins/telemetry/v1.3.54","plugins/semanticcache/v1.3.54","plugins/otel/v1.0.54","plugins/mocker/v1.3.54","plugins/maxim/v1.4.55","plugins/logging/v1.3.55","plugins/jsonparser/v1.3.55","plugins/governance/v1.3.55","framework/v1.1.54","core/v1.2.44","transports/v1.3.54","plugins/telemetry/v1.3.53","plugins/semanticcache/v1.3.53","plugins/otel/v1.0.53","core/v1.2.43","plugins/mocker/v1.3.53","plugins/maxim/v1.4.54","plugins/logging/v1.3.54","plugins/jsonparser/v1.3.54","plugins/governance/v1.3.54","framework/v1.1.53","transports/v1.3.53","plugins/telemetry/v1.3.52","plugins/semanticcache/v1.3.52","plugins/otel/v1.0.52","plugins/mocker/v1.3.52","plugins/maxim/v1.4.53","plugins/logging/v1.3.53","plugins/jsonparser/v1.3.53","plugins/governance/v1.3.53","framework/v1.1.52","core/v1.2.42","transports/v1.3.52","plugins/telemetry/v1.3.51","plugins/semanticcache/v1.3.51","plugins/otel/v1.0.51","plugins/mocker/v1.3.51","plugins/maxim/v1.4.52","plugins/logging/v1.3.52","plugins/jsonparser/v1.3.52","plugins/governance/v1.3.52","framework/v1.1.51","core/v1.2.41","transports/v1.3.51","plugins/telemetry/v1.3.50","plugins/semanticcache/v1.3.50","plugins/otel/v1.0.50","plugins/mocker/v1.3.50","plugins/maxim/v1.4.51","plugins/logging/v1.3.51","plugins/jsonparser/v1.3.51","plugins/governance/v1.3.51","framework/v1.1.50","core/v1.2.40","transports/v1.3.50","plugins/telemetry/v1.3.49","plugins/semanticcache/v1.3.49","plugins/otel/v1.0.49","plugins/mocker/v1.3.49","plugins/maxim/v1.4.50","plugins/logging/v1.3.50","plugins/jsonparser/v1.3.50","plugins/governance/v1.3.50","framework/v1.1.49","helm-chart-v1.5.1","core/v1.2.39","transports/v1.3.49","plugins/telemetry/v1.3.48","plugins/semanticcache/v1.3.48","plugins/otel/v1.0.48","plugins/mocker/v1.3.48","plugins/maxim/v1.4.49","plugins/logging/v1.3.49","plugins/jsonparser/v1.3.49","plugins/governance/v1.3.49","framework/v1.1.48","core/v1.2.38","transports/v1.3.48","transports/v1.3.47","plugins/telemetry/v1.3.47","plugins/semanticcache/v1.3.47","plugins/otel/v1.0.47","plugins/mocker/v1.3.47","plugins/maxim/v1.4.48","plugins/logging/v1.3.48","plugins/jsonparser/v1.3.48","plugins/governance/v1.3.48","framework/v1.1.47","core/v1.2.37","transports/v1.3.46","helm-chart-v1.5.0","transports/v1.3.45","plugins/telemetry/v1.3.46","plugins/semanticcache/v1.3.46","plugins/otel/v1.0.46","plugins/mocker/v1.3.46","plugins/maxim/v1.4.47","plugins/logging/v1.3.47","plugins/jsonparser/v1.3.47","plugins/governance/v1.3.47","framework/v1.1.46","core/v1.2.36","transports/v1.3.44","plugins/telemetry/v1.3.45","plugins/semanticcache/v1.3.45","plugins/otel/v1.0.45","plugins/mocker/v1.3.45","plugins/maxim/v1.4.46","plugins/logging/v1.3.46","plugins/jsonparser/v1.3.46","plugins/governance/v1.3.46","helm-chart-v1.4.3","framework/v1.1.45","transports/v1.3.43","plugins/telemetry/v1.3.44","plugins/semanticcache/v1.3.44","plugins/otel/v1.0.44","plugins/mocker/v1.3.44","plugins/maxim/v1.4.45","plugins/logging/v1.3.45","plugins/jsonparser/v1.3.45","plugins/governance/v1.3.45","framework/v1.1.44","core/v1.2.35","helm-chart-v1.4.2","transports/v1.3.42","plugins/telemetry/v1.3.43","plugins/semanticcache/v1.3.43","plugins/otel/v1.0.43","plugins/mocker/v1.3.43","plugins/maxim/v1.4.44","plugins/logging/v1.3.44","plugins/jsonparser/v1.3.44","plugins/governance/v1.3.44","framework/v1.1.43","core/v1.2.34","transports/v1.3.41","plugins/maxim/v1.4.43","transports/v1.3.40","transports/v1.3.39","plugins/telemetry/v1.3.42","plugins/semanticcache/v1.3.42","plugins/otel/v1.0.42","plugins/mocker/v1.3.42","plugins/maxim/v1.4.42","plugins/logging/v1.3.43","plugins/jsonparser/v1.3.43","plugins/governance/v1.3.43","framework/v1.1.42","core/v1.2.33","transports/v1.3.38","plugins/telemetry/v1.3.41","plugins/semanticcache/v1.3.41","plugins/otel/v1.0.41","plugins/mocker/v1.3.41","plugins/maxim/v1.4.41","plugins/logging/v1.3.42","plugins/jsonparser/v1.3.42","plugins/governance/v1.3.42","framework/v1.1.41","core/v1.2.32","helm-chart-v1.4.1","helm-chart-v1.4.0","transports/v1.3.37","plugins/semanticcache/v1.3.40","plugins/telemetry/v1.3.40","plugins/otel/v1.0.40","plugins/mocker/v1.3.40","plugins/maxim/v1.4.40","plugins/logging/v1.3.41","plugins/jsonparser/v1.3.41","plugins/governance/v1.3.41","framework/v1.1.40","core/v1.2.31","helm-chart-v1.3.37","helm-chart-v1.3.36","transports/v1.3.36","plugins/telemetry/v1.3.39","plugins/semanticcache/v1.3.39","plugins/otel/v1.0.39","plugins/mocker/v1.3.39","plugins/maxim/v1.4.39","plugins/logging/v1.3.40","plugins/jsonparser/v1.3.40","plugins/governance/v1.3.40","framework/v1.1.39","transports/v1.3.35","plugins/telemetry/v1.3.38","plugins/semanticcache/v1.3.38","plugins/otel/v1.0.38","plugins/mocker/v1.3.38","plugins/maxim/v1.4.38","plugins/logging/v1.3.39","plugins/jsonparser/v1.3.39","plugins/governance/v1.3.39","framework/v1.1.38","core/v1.2.30","transports/v1.3.34","plugins/telemetry/v1.3.37","plugins/semanticcache/v1.3.37","plugins/otel/v1.0.37","plugins/mocker/v1.3.37","plugins/maxim/v1.4.37","plugins/logging/v1.3.38","plugins/jsonparser/v1.3.38","plugins/governance/v1.3.38","framework/v1.1.37","transports/v1.3.33","plugins/telemetry/v1.3.36","plugins/semanticcache/v1.3.36","plugins/otel/v1.0.36","plugins/mocker/v1.3.36","plugins/maxim/v1.4.36","plugins/logging/v1.3.37","plugins/jsonparser/v1.3.37","plugins/governance/v1.3.37","framework/v1.1.36","core/v1.2.29","transports/v1.3.32","plugins/telemetry/v1.3.35","plugins/semanticcache/v1.3.35","plugins/otel/v1.0.35","plugins/mocker/v1.3.35","plugins/maxim/v1.4.35","plugins/logging/v1.3.36","plugins/jsonparser/v1.3.36","plugins/governance/v1.3.36","framework/v1.1.35","core/v1.2.28","transports/v1.3.31","plugins/telemetry/v1.3.34","plugins/semanticcache/v1.3.34","plugins/otel/v1.0.34","plugins/mocker/v1.3.34","plugins/maxim/v1.4.34","plugins/logging/v1.3.35","plugins/jsonparser/v1.3.35","plugins/governance/v1.3.35","framework/v1.1.34","core/v1.2.27","transports/v1.3.30","plugins/telemetry/v1.3.33","plugins/semanticcache/v1.3.33","plugins/otel/v1.0.33","plugins/mocker/v1.3.33","plugins/maxim/v1.4.33","plugins/logging/v1.3.34","plugins/jsonparser/v1.3.34","plugins/governance/v1.3.34","framework/v1.1.33","transports/v1.3.29","plugins/telemetry/v1.3.32","plugins/semanticcache/v1.3.32","plugins/otel/v1.0.32","plugins/mocker/v1.3.32","plugins/maxim/v1.4.32","plugins/logging/v1.3.33","plugins/jsonparser/v1.3.33","plugins/governance/v1.3.33","framework/v1.1.32","core/v1.2.26","helm-chart-v1.3.5","transports/v1.3.28","plugins/logging/v1.3.32","plugins/telemetry/v1.3.31","plugins/semanticcache/v1.3.31","plugins/otel/v1.0.31","plugins/mocker/v1.3.31","plugins/maxim/v1.4.31","plugins/jsonparser/v1.3.32","plugins/governance/v1.3.32","framework/v1.1.31","transports/v1.3.27","plugins/telemetry/v1.3.30","plugins/semanticcache/v1.3.30","plugins/otel/v1.0.30","plugins/mocker/v1.3.30","plugins/maxim/v1.4.30","plugins/logging/v1.3.31","plugins/jsonparser/v1.3.31","plugins/governance/v1.3.31","framework/v1.1.30","core/v1.2.25"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86242.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}