Go/github.com/envoyproxy/ai-gateway: medium
agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable
Action: Upgrade github.com/envoyproxy/ai-gateway to 1.2.0-rc1 or later.
go get github.com/envoyproxy/ai-gateway@v1.2.0-rc1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.4.0-rc1 | 1.2.0-rc1 | - |
Fixed versions
| 1.2.0-rc1 |
Sources
- osv: GHSA-953h-535j-jg2v
- https://github.com/theagentrouter/agent-router/security/advisories/GHSA-953h-535j-jg2v
- https://github.com/theagentrouter/agent-router/pull/2740
- https://github.com/theagentrouter/agent-router/pull/2755
- https://github.com/theagentrouter/agent-router/commit/0d1e73037076d72251342d0ea578a36ffb7002c7
- https://github.com/theagentrouter/agent-router/commit/994579660ae2a9f2feef3cb77766e155746858b4
- https://github.com/theagentrouter/agent-router
published · modified · JSON