{"id":"ghsa-ghsa-953h-535j-jg2v","seq":2443,"kind":"advisory","title":"agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable","url":"https://github.com/advisories/GHSA-953h-535j-jg2v","permalink":"https://vulnpulse.app/items/ghsa-ghsa-953h-535j-jg2v","summary":"影響: go:github.com/envoyproxy/ai-gateway >= 0.4.0-rc1, < 1.2.0-rc1 → 1.2.0-rc1\nSummary The MCP proxy's client-facing session ID embeds the authenticated caller's subject (JWT sub claim) specifically as an anti-hijacking discriminator — matching the Model Context Protocol specification's documented session-hijacking guidance (https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices#session-hijacking). However, the session-resume path never checks that discriminator against the current caller's identity, so any client that obtains a session ID…","severity":"medium","techs":["go","github"],"cves":[],"tags":["GHSA-953h-535j-jg2v","github.com/envoyproxy/ai-gateway"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-19T16:53:26.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}