MediumVulnerability
GHSA-4gph-2hhr-5mwg: Envoy AI Proxy - MCP Message Smuggling Vulnerability
- Identifier
- GHSA-4gph-2hhr-5mwg
- Published
- Record updated
- Affected
- github.com/envoyproxy/ai-gateway < 0.6.0
- Fixed in
- 0.6.0
- released May 5, 2026, 14 days before disclosure
Summary
Envoy AI Gateway's MCP proxy parses JSON-RPC 2.0 messages case-insensitively, contrary to the MCP-mandated case-sensitive matching, via `jsonrpc.DecodeMessage` in `github.com/modelcontextprotocol/go-sdk` and the `internal/json` wrapper around `github.com/bytedance/sonic`. An attacker can send a message with a case-variant `Name` field alongside `name`, and the gateway re-serializes it with the injected value, so the upstream backend receives a different tool call (e.g. `backend__secretTool` instead of `backend__greet`), potentially bypassing authorization checks applied earlier.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Topics
Related items
- InfoOpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the LineSimilar attack · SecurityWeek
- MediumMalicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' ComputersSimilar attack · The Hacker News
- LowRailway’s AI agents go off the track on a rival’s networkSimilar attack · CSO Online
- MediumOpenAI Model Wrote Its Own Network Code to Get Around Sandbox RestrictionsSimilar attack · SecurityWeek
- MediumChainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key ServicesSimilar attack · The Hacker News