VULNRABLE / Vulnerability / GHSA-953h-535j-jg2v
GHSA-953h-535j-jg2v
MEDIUM LOW github.com/envoyproxy/ai-gateway GHSA
Exploit verdict: No active-exploit signal
CVSS Score
5.5
Severity
MEDIUM
EPSS
—
Source
GHSA
Summary
agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable
What this means
GHSA-953h-535j-jg2v is a medium-severity vulnerability affecting github.com/envoyproxy/ai-gateway, rated CVSS 5.5. Published October 19, 2026.
View full advisory at GHSA →