CVE-2022-39219

Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only have read permissions to write requests when they are normally forbidden from doing so. Version 1.8.7-release contains a patch. There are currently no known workarounds.

• CWE-287
• CWE-287

• https://github.com/brokercap/Bifrost/issues/200Exploit, Issue Tracking, Third Party Advisory
• https://github.com/brokercap/Bifrost/releases/tag/v1.8.7-releaseRelease Notes, Third Party Advisory
• https://github.com/brokercap/Bifrost/security/advisories/GHSA-p6fh-xc6r-g5hwThird Party Advisory
• https://github.com/brokercap/Bifrost/issues/200Exploit, Issue Tracking, Third Party Advisory
• https://github.com/brokercap/Bifrost/releases/tag/v1.8.7-releaseRelease Notes, Third Party Advisory
• https://github.com/brokercap/Bifrost/security/advisories/GHSA-p6fh-xc6r-g5hwThird Party Advisory

Published

Sep 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39213go-cvss is a Go module to manipulate Common Vulnerability Sc…7.5
• CVE-2022-39214Combodo iTop is an open source, web-based IT service managem…7.5
• CVE-2022-39215Tauri is a framework for building binaries for all major des…5.8
• CVE-2022-39216Combodo iTop is an open source, web-based IT service managem…9.8
• CVE-2022-39217some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) i…9.8
• CVE-2022-39218The JS Compute Runtime for Fastly's Compute@Edge platform pr…7.5
• CVE-2022-3922The Broken Link Checker WordPress plugin before 1.11.20 does…4.8
• CVE-2022-39220SFTPGo is an SFTP server written in Go. Versions prior to 2.…6.1
• CVE-2022-39221McWebserver mod runs a simple HTTP server alongside the Mine…7.5
• CVE-2022-39222Dex is an identity service that uses OpenID Connect to drive…6.5
• CVE-2022-39224Arr-pm is an RPM reader/writer library written in Ruby. Vers…7.8
• CVE-2022-39225Parse Server is an open source backend that can be deployed …3.1