Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4, published 19 October 2026.

Which products and versions are affected?

Agent-Router prior to fix; Envoy AI Gateway = 0.4.0-rc1, < 1.2.0-rc1, SEMVER:introduced=0.4.0-rc1,fixed=1.2.0-rc1.

How is This vulnerability attacked?

It is attacked with local access or over the network.

Check whether you run Agent-Router, Envoy AI Gateway or github.com/envoyproxy/ai-gateway (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Envoy AI Gateway MCP session hijacking via missing subject verification

Q: Is there a fix for This vulnerability?

Yes. github.com/envoyproxy/ai-gateway (Go): upgrade to 1.2.0-rc1 or later. Until then: Change the controller.mcp.sessionEncryption.seed setting in the Helm chart values from the default "default-insecure-seed" to a strong randomly-generated value, and ensure --mcpSessionEncryptionSeed is explicitly set rather than left to its hardcoded default. Additionally, restrict access to the MCP routes at the network level until the fix can be applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked with local access or over the network.

Q: Am I affected?

Check whether you run Agent-Router, Envoy AI Gateway or github.com/envoyproxy/ai-gateway (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 4 · Published 2026-10-19

Envoy AI Gateway is a reverse proxy that routes API requests to backend services, including Model Context Protocol (MCP) servers used in AI applications. An attacker can hijack another user's MCP session by forging or capturing their session ID, then resuming that session to read conversation state and invoke tools or resources as that other user. The risk is amplified by the official Helm chart shipping a publicly known default encryption seed, allowing attackers to forge session IDs entirely without capturing a real one.

Technologies: github.com/envoyproxy/ai-gateway (Go). Vendors: Envoy, Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4, published 19 October 2026.
Which products and versions are affected?: Agent-Router prior to fix; Envoy AI Gateway <= 1.1.0; github.com/envoyproxy/ai-gateway (Go) >= 0.4.0-rc1, < 1.2.0-rc1, SEMVER:introduced=0.4.0-rc1,fixed=1.2.0-rc1.
Is there a fix for This vulnerability?: Yes. github.com/envoyproxy/ai-gateway (Go): upgrade to 1.2.0-rc1 or later. Until then: Change the controller.mcp.sessionEncryption.seed setting in the Helm chart values from the default "default-insecure-seed" to a strong randomly-generated value, and ensure --mcpSessionEncryptionSeed is explicitly set rather than left to its hardcoded default. Additionally, restrict access to the MCP routes at the network level until the fix can be applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked with local access or over the network.
Am I affected?: Check whether you run Agent-Router, Envoy AI Gateway or github.com/envoyproxy/ai-gateway (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/envoyproxy/ai-gateway (Go): upgrade to 1.2.0-rc1 or later
```
go get github.com/envoyproxy/ai-gateway@v1.2.0-rc1
```

Change the controller.mcp.sessionEncryption.seed setting in the Helm chart values from the default "default-insecure-seed" to a strong randomly-generated value, and ensure --mcpSessionEncryptionSeed is explicitly set rather than left to its hardcoded default. Additionally, restrict access to the MCP routes at the network level until the fix can be applied.

Technical details

The vulnerability stems from two defects: (1) the session-resume code path decrypts the session ID but never compares the embedded user subject (JWT sub claim) against the current requester's identity, despite the subject being embedded specifically for anti-hijacking purposes; (2) the Helm chart defaults the session encryption seed to "default-insecure-seed", allowing an attacker knowing the seed and PBKDF2 iteration count to derive the AES-GCM key and encrypt arbitrary session structures. An authenticated or unauthenticated attacker can thus resume another user's session and call JSON-RPC methods like tools/call or resources/read in that user's context.

Affected products

Envoy AI Gateway <= 1.1.0

Timeline

2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.