{"id":"GHSA-g53w-w6mj-hrpp","summary":"MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin \"router-key\" / \"mcp-init-host\" path","details":"## Summary\n \nThe MCP router (ext_proc) exposes an `initialize`-method code path that, when a\nrequest carries an `mcp-init-host` header, bypasses the gateway JWT session\nvalidator and rewrites the upstream `:authority` header to whatever the caller\nchooses, gated only by a single shared header value (`router-key`). The shared\nvalue is\n\n* a literal string (`secret-api-key`) baked into `cmd/mcp-broker-router/main.go`\n  as a fall-back default, and\n* in controller-managed deployments, a SHA-256 truncation of the\n  `MCPGatewayExtension` UID — a non-secret value visible to anyone with `get`\n  permission on the resource, and additionally exposed in `argv` because it is\n  passed to the broker-router container via `--mcp-router-key=...`.\n\nA request that satisfies the trivial header check is forwarded to any backend\nlistener registered with the gateway (including external services such as\n`api.githubcopilot.com` when configured), bypassing both the broker (where the\nsigned `x-mcp-authorized` capability filter is enforced) and the gateway's\nJWT-based session model.","aliases":["GO-2026-5390"],"modified":"2026-07-21T15:00:41.004364690Z","published":"2026-05-19T19:42:46Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-287","CWE-346","CWE-639"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2026-05-19T19:42:46Z"},"references":[{"type":"WEB","url":"https://github.com/Kuadrant/mcp-gateway/security/advisories/GHSA-g53w-w6mj-hrpp"},{"type":"WEB","url":"https://github.com/Kuadrant/mcp-gateway/commit/6052079283472aff99727058c92618178f86b2d7"},{"type":"PACKAGE","url":"https://github.com/Kuadrant/mcp-gateway"},{"type":"WEB","url":"https://github.com/Kuadrant/mcp-gateway/releases/tag/v0.7.0"}],"affected":[{"package":{"name":"github.com/Kuadrant/mcp-gateway","ecosystem":"Go","purl":"pkg:golang/github.com/Kuadrant/mcp-gateway"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-g53w-w6mj-hrpp/GHSA-g53w-w6mj-hrpp.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}