MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path
Critical severity
GitHub Reviewed
Published
May 13, 2026
in
Kuadrant/mcp-gateway
•
Updated Jul 21, 2026
Give feedback on Dependabot alerts