Your Session, My Policy: An MCP Gateway Authorization Bypass in Agentgateway, and the Move to Stateless MCP
An MCP session could reuse a restricted backend under another route’s permissive policy. A two-route reproduction explains the authorization bypass and Agentgateway v1.4.0’s fix.