Unauthenticated RCE in maximhq/Bifrost where the management API registers MCP stdio clients as a command+args and immediately executes it without an MCP handshake. With default governance.auth_config.is_enabled=false, a single unauthenticated POST /api/mcp/client runs attacker-chosen programs as the Bifrost process user (appuser).

Affected versions: `