{"data":{"id":"aa1b2616-630b-4b86-aa47-88dc5fc86f9f","title":"GHSA-4gph-2hhr-5mwg: Envoy AI Proxy - MCP Message Smuggling Vulnerability","summary":"Envoy AI Gateway's MCP proxy parses JSON-RPC 2.0 messages case-insensitively, contrary to the MCP-mandated case-sensitive matching, via `jsonrpc.DecodeMessage` in `github.com/modelcontextprotocol/go-sdk` and the `internal/json` wrapper around `github.com/bytedance/sonic`. An attacker can send a message with a case-variant `Name` field alongside `name`, and the gateway re-serializes it with the injected value, so the upstream backend receives a different tool call (e.g. `backend__secretTool` instead of `backend__greet`), potentially bypassing authorization checks applied earlier.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-4gph-2hhr-5mwg","publishedAt":"2026-05-19T16:18:14.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/envoyproxy/ai-gateway@< 0.6.0 (fixed: 0.6.0)"],"affectedPackageNames":["github.com/envoyproxy/ai-gateway"],"affectedPackageRefs":["go:github.com/envoyproxy/ai-gateway"],"affectedVendors":[],"affectedVendorsRaw":["Envoy AI Gateway","Model Context Protocol","modelcontextprotocol/go-sdk"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-4gph-2hhr-5mwg"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-19T16:18:14.000Z","fixReleasedAt":"2026-05-05T18:49:36.000Z","daysToFix":-14,"fixCheckedAt":"2026-10-29T21:35:44.208Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/envoyproxy/ai-gateway","fixedVersion":"0.6.0","matchedVersion":"v0.6.0","fixReleasedAt":"2026-05-05T18:49:36.000Z","daysToFix":-14,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:35:44.062Z"}]}}