Go/github.com/Kuadrant/mcp-gateway: critical
MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path
Action: Upgrade github.com/Kuadrant/mcp-gateway to 0.7.0 or later.
go get github.com/Kuadrant/mcp-gateway@v0.7.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.7.0 | - |
Fixed versions
| 0.7.0 |
Sources
- osv: GHSA-g53w-w6mj-hrpp
- https://github.com/Kuadrant/mcp-gateway/security/advisories/GHSA-g53w-w6mj-hrpp
- https://github.com/Kuadrant/mcp-gateway/commit/6052079283472aff99727058c92618178f86b2d7
- https://github.com/Kuadrant/mcp-gateway
- https://github.com/Kuadrant/mcp-gateway/releases/tag/v0.7.0
published · modified · JSON