{"action":"Upgrade github.com/Kuadrant/mcp-gateway to 0.7.0 or later.","affected":[{"fixed":"0.7.0","introduced":"0"}],"component":"github.com/Kuadrant/mcp-gateway","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["0.7.0"],"ghsa_id":"GHSA-g53w-w6mj-hrpp","id":"tcs_01M5KFAADH4A02B2X0ND1XZ8GP","modified_at":"2026-07-21T15:00:41.004364690Z","published_at":"2026-05-19T19:42:46Z","references":["https://osv.dev/vulnerability/GHSA-g53w-w6mj-hrpp","https://github.com/Kuadrant/mcp-gateway/security/advisories/GHSA-g53w-w6mj-hrpp","https://github.com/Kuadrant/mcp-gateway/commit/6052079283472aff99727058c92618178f86b2d7","https://github.com/Kuadrant/mcp-gateway","https://github.com/Kuadrant/mcp-gateway/releases/tag/v0.7.0"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-g53w-w6mj-hrpp","url":"https://osv.dev/vulnerability/GHSA-g53w-w6mj-hrpp"}],"summary":"MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin \"router-key\" / \"mcp-init-host\" path"}