{"id":"GHSA-g53w-w6mj-hrpp","aliases":["GO-2026-5390"],"url":"https://o3.security/vulnerability/GHSA-g53w-w6mj-hrpp","summary":"MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin \"router-key\" / \"mcp-init-host\" path","details":"## Summary\n \nThe MCP router (ext_proc) exposes an `initialize`-method code path that, when a\nrequest carries an `mcp-init-host` header, bypasses the gateway JWT session\nvalidator and rewrites the upstream `:authority` header to whatever the caller\nchooses, gated only by a single shared header value (`router-key`). The shared\nvalue is\n\n* a literal string (`secret-api-key`) baked into `cmd/mcp-broker-router/main.go`\n  as a fall-back default, and\n* in controller-managed deployments, a SHA-256 truncation of the\n  `MCPGatewayExtension` UID — a non-secret value visible to anyone with `get`\n  permission on the resource, and additionally exposed in `argv` because it is\n  passed to the broker-router container via `--mcp-router-key=...`.\n\nA request that satisfies the trivial header check is forwarded to any backend\nlistener registered with the gateway (including external services such as\n`api.githubcopilot.com` when configured), bypassing both the broker (where the\nsigned `x-mcp-authorized` capability filter is enforced) and the gateway's\nJWT-based session model.","published":"2026-05-19T19:42:46Z","modified":"2026-07-21T15:00:41.004364690Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/Kuadrant/mcp-gateway","fixedVersion":"0.7.0"}],"fix":{"url":"https://github.com/Kuadrant/mcp-gateway/commit/6052079283472aff99727058c92618178f86b2d7","label":"Kuadrant/mcp-gateway@6052079"},"references":[{"type":"WEB","url":"https://github.com/Kuadrant/mcp-gateway/security/advisories/GHSA-g53w-w6mj-hrpp"},{"type":"WEB","url":"https://github.com/Kuadrant/mcp-gateway/commit/6052079283472aff99727058c92618178f86b2d7"},{"type":"PACKAGE","url":"https://github.com/Kuadrant/mcp-gateway"},{"type":"WEB","url":"https://github.com/Kuadrant/mcp-gateway/releases/tag/v0.7.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-21T15:00:41.004364690Z"}}