GO-2026-5390 - MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in githu

Severity: info · Published 2026-06-25

Technologies: github.com/Kuadrant/mcp-gateway (Go). Vendors: Go.

Executive brief

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway

Affected products

Go github.com/Kuadrant/mcp-gateway

Related threats

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path
Kuadrant MCP Gateway auth bypass and authority injection