CRITICALGo
GHSA-g53w-w6mj-hrpp· GO-2026-5390MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path
Modified: 7/21/2026
package
Go/github.com/Kuadrant/mcp-gateway
pkg:go/github.com/Kuadrant/mcp-gateway
—Go
GO-2026-5390· GHSA-g53w-w6mj-hrppMCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway
Modified: 6/25/2026