{"action":"Upgrade github.com/envoyproxy/ai-gateway to 1.2.0-rc1 or later.","affected":[{"fixed":"1.2.0-rc1","introduced":"0.4.0-rc1"}],"component":"github.com/envoyproxy/ai-gateway","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["1.2.0-rc1"],"ghsa_id":"GHSA-953h-535j-jg2v","id":"tcs_01M5JHJN236NZS6KKGD376NSQJ","modified_at":"2026-10-19T17:00:04.042439008Z","published_at":"2026-10-19T16:53:26Z","references":["https://osv.dev/vulnerability/GHSA-953h-535j-jg2v","https://github.com/theagentrouter/agent-router/security/advisories/GHSA-953h-535j-jg2v","https://github.com/theagentrouter/agent-router/pull/2740","https://github.com/theagentrouter/agent-router/pull/2755","https://github.com/theagentrouter/agent-router/commit/0d1e73037076d72251342d0ea578a36ffb7002c7","https://github.com/theagentrouter/agent-router/commit/994579660ae2a9f2feef3cb77766e155746858b4","https://github.com/theagentrouter/agent-router"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-953h-535j-jg2v","url":"https://osv.dev/vulnerability/GHSA-953h-535j-jg2v"}],"summary":"agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable"}