Skip to content
OpenAdvisories

Package · Go

github.com/Kuadrant/mcp-gateway

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical —
    GHSA-g53w-w6mj-hrpp

    MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path

    ## Summary The MCP router (ext_proc) exposes an `initialize`-method code path that, when a request carries an `mcp-init-host` header, bypasses the gateway JWT session validator and rewrites the upstream `:authority` header to whatever the caller chooses, gate…

    github.com/Kuadrant/mcp-gateway Go