GHSA-g53w-w6mj-hrpp MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path

• Go github.com/Kuadrant/mcp-gateway: < 0.7.0 → fixed in 0.7.0

Summary The MCP router (ext_proc) exposes an `initialize`-method code path that, when a request carries an `mcp-init-host` header, bypasses the gateway JWT session validator and rewrites the upstream `:authority` header to whatever the caller chooses, gated only by a single shared header value (`router-key`). The shared value is • a literal string (`secret-api-key`) baked into `cmd/mcp-broker-router/main.go` as a fall-back default, and • in controller-managed deployments, a SHA-256 truncation of the `MCPGatewayExtension` UID — a non-secret value visible to anyone with `get` permission on the resource, and additionally exposed in `argv` because it is passed to the broker-router container via `--mcp-router-key=...`. A request that satisfies the trivial header check is forwarded to any backend listener registered with the gateway (including external services such as `api.githubcopilot.com` when configured), bypassing both the broker (where the signed `x-mcp-authorized` capability filter is enforced) and the gateway's JWT-based session model.