MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway

GHSA-g53w-w6mj-hrpp · GO-2026-5390 · Published 25/06/2026 · updated 25/06/2026

In short

GO-2026-5390 is a not yet rated vulnerability affecting github.com/Kuadrant/mcp-gateway.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
github.com/Kuadrant/mcp-gateway Go	`all versions`	No fix yet

Description

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway

References

Kuadrant/mcp-gateway security advisory · ADVISORY

More vulnerabilities in github.com/Kuadrant/mcp-gateway

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free