---
id: GHSA-g53w-w6mj-hrpp
aliases:
  - GO-2026-5390
title: >-
  MCP Gateway: Authority-injection and JWT/session bypass via the
  unauthenticated router hair-pin "router-key" / "mcp-init-host" path
summary: >-
  MCP Gateway: Authority-injection and JWT/session bypass via the
  unauthenticated router hair-pin "router-key" / "mcp-init-host" path
severity: critical
vendor: Kuadrant
product: github.com/Kuadrant/mcp-gateway
ecosystem: go
affected:
  - github.com/Kuadrant/mcp-gateway < 0.7.0
patched:
  - github.com/Kuadrant/mcp-gateway 0.7.0
published: '2026-05-19'
updated: '2026-07-21'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-g53w-w6mj-hrpp'
references:
  - url: >-
      https://github.com/Kuadrant/mcp-gateway/security/advisories/GHSA-g53w-w6mj-hrpp
  - url: >-
      https://github.com/Kuadrant/mcp-gateway/commit/6052079283472aff99727058c92618178f86b2d7
  - url: 'https://github.com/Kuadrant/mcp-gateway'
  - url: 'https://github.com/Kuadrant/mcp-gateway/releases/tag/v0.7.0'
tags:
  - osv
  - go
ingestedAt: '2026-07-21T19:04:58.952Z'
---

## Overview

## Summary
 
The MCP router (ext_proc) exposes an `initialize`-method code path that, when a
request carries an `mcp-init-host` header, bypasses the gateway JWT session
validator and rewrites the upstream `:authority` header to whatever the caller
chooses, gated only by a single shared header value (`router-key`). The shared
value is

* a literal string (`secret-api-key`) baked into `cmd/mcp-broker-router/main.go`
  as a fall-back default, and
* in controller-managed deployments, a SHA-256 truncation of the
  `MCPGatewayExtension` UID — a non-secret value visible to anyone with `get`
  permission on the resource, and additionally exposed in `argv` because it is
  passed to the broker-router container via `--mcp-router-key=...`.

A request that satisfies the trivial header check is forwarded to any backend
listener registered with the gateway (including external services such as
`api.githubcopilot.com` when configured), bypassing both the broker (where the
signed `x-mcp-authorized` capability filter is enforced) and the gateway's
JWT-based session model.

## Affected packages

- `github.com/Kuadrant/mcp-gateway < 0.7.0`

## Remediation

Upgrade to a patched release:

- `github.com/Kuadrant/mcp-gateway 0.7.0`