GHSA-g53w-w6mj-hrpp
MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path
Summary
The MCP router (ext_proc) exposes an initialize-method code path that, when a
request carries an mcp-init-host header, bypasses the gateway JWT session
validator and rewrites the upstream :authority header to whatever the caller
chooses, gated only by a single shared header value (router-key). The shared
value is
- a literal string (
secret-api-key) baked intocmd/mcp-broker-router/main.goas a fall-back default, and - in controller-managed deployments, a SHA-256 truncation of the
MCPGatewayExtensionUID — a non-secret value visible to anyone withgetpermission on the resource, and additionally exposed inargvbecause it is passed to the broker-router container via--mcp-router-key=....
A request that satisfies the trivial header check is forwarded to any backend
listener registered with the gateway (including external services such as
api.githubcopilot.com when configured), bypassing both the broker (where the
signed x-mcp-authorized capability filter is enforced) and the gateway's
JWT-based session model.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
What each source reports
GitHub Advisories Score used
MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path
Summary
The MCP router (ext_proc) exposes an initialize-method code path that, when a
request carries an mcp-init-host header, bypasses the gateway JWT session
validator and rewrites the upstream :authority header to whatever the caller
chooses, gated only by a single shared header value (router-key). The shared
value is
- a literal string (
secret-api-key) baked intocmd/mcp-broker-router/main.goas a fall-back default, and - in controller-managed deployments, a SHA-256 truncation of the
MCPGatewayExtensionUID — a non-secret value visible to anyone withgetpermission on the resource, and additionally exposed inargvbecause it is passed to the broker-router container via--mcp-router-key=....
A request that satisfies the trivial header check is forwarded to any backend
listener registered with the gateway (including external services such as
api.githubcopilot.com when configured), bypassing both the broker (where the
signed x-mcp-authorized capability filter is enforced) and the gateway's
JWT-based session model.
- Record
GHSA-g53w-w6mj-hrpp- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-287, CWE-346, CWE-639
- Updated
- 2026-11-02
OSV
MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path
Summary
The MCP router (ext_proc) exposes an initialize-method code path that, when a
request carries an mcp-init-host header, bypasses the gateway JWT session
validator and rewrites the upstream :authority header to whatever the caller
chooses, gated only by a single shared header value (router-key). The shared
value is
- a literal string (
secret-api-key) baked intocmd/mcp-broker-router/main.goas a fall-back default, and - in controller-managed deployments, a SHA-256 truncation of the
MCPGatewayExtensionUID — a non-secret value visible to anyone withgetpermission on the resource, and additionally exposed inargvbecause it is passed to the broker-router container via--mcp-router-key=....
A request that satisfies the trivial header check is forwarded to any backend
listener registered with the gateway (including external services such as
api.githubcopilot.com when configured), bypassing both the broker (where the
signed x-mcp-authorized capability filter is enforced) and the gateway's
JWT-based session model.
- Record
GHSA-g53w-w6mj-hrpp- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-287, CWE-346, CWE-639
- Updated
- 2026-11-02
OSVGO-2026-5390No score
MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway
MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway
- Record
GO-2026-5390- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/Kuadrant/mcp-gatewayGo | before 0.7.0 | 0.7.0 |
github.com/Kuadrant/mcp-gatewayGo | All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-g53w-w6mj-hrpp is a critical vulnerability (CVSS 9.3) in github.com/Kuadrant/mcp-gateway, published May 19, 2026. No source lists public exploit code. Fixed in github.com/Kuadrant/mcp-gateway 0.7.0.