MCP Gateway: Potential Authority Injection and JWT Bypass
An early warning has been issued regarding a potential vulnerability in the MCP Gateway that could allow authority injection and bypass of JWT session validation through an unauthenticated path.
What happened
Reportedly, the MCP router exposes an initialize method code path that, when a request carries an mcp-init-host header, bypasses the gateway JWT session validator and rewrites the upstream :authority header. This appears to enable authority injection and JWT/session bypass. The affected component is the mcp-gateway (go), introduced in version 0 and fixed in version 0.7.0.
Professional software engineers using the MCP Gateway are advised to review and update the mcp-router-key configuration to prevent unauthorized access and ensure proper validation of headers. This incident is under investigation, and further details should be consulted from the primary sources.
For more information, refer to the GitHub Advisory Database entry [GHSA-g53w-w6mj-hrpp](https://github.com/advisories/GHSA-g53w-w6mj-hrpp).
How 0Day mitigates this
mcp-gateway is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.