MediumVulnerability
GHSA-953h-535j-jg2v: agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable
- Identifier
- GHSA-953h-535j-jg2v
- Published
- Record updated
- Affected
- github.com/envoyproxy/ai-gateway >= 0.4.0-rc1, < 1.2.0-rc1
- Fixed in
- 1.2.0-rc1
Summary
The Envoy AI Gateway MCP proxy's session-resume path never checks the subject (JWT `sub` claim) embedded in the client-facing session ID, so any client holding a session ID can resume another user's session and invoke backend methods such as `tools/call` and `resources/read`. The official Helm chart aggravates this by defaulting the session encryption seed to the publicly known `"default-insecure-seed"`, which would let an attacker forge session IDs.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Topics
Related items
- MediumGHSA-2658-85cv-9wwq: Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTMLSimilar attack · GitHub Advisory Database
- InfoInside the Underground Market for Know Your Client ServicesSimilar attack · BleepingComputer
- MediumA hacker broke into John Deere and SharkNinja with an army of AI agentsSimilar attack · The Verge (AI)
- MediumCVE-2026-112081: hankcs HanLP deserialization through classpath in hanlp.loadSimilar attack · NVD/CVE Database
- MediumCVE-2026-111991: WongKinYiu yolov9 code injection via ONNX Metadata HandlerSimilar attack · NVD/CVE Database