Junglewise Threat Intelligence

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path

Severity: medium · CVSS 4 · Published 2026-05-19

Technologies: github.com/Kuadrant/mcp-gateway (Go). Vendors: Go.

Executive brief

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path

Affected products

Go github.com/Kuadrant/mcp-gateway

Related threats

GO-2026-5390 - MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in githu
Kuadrant MCP Gateway auth bypass and authority injection