Agent Router Published the Session Bug 12 Days After v1.2.0.

US trends at 22:44 UTC were the Eagles, Monday Night Football, and Bronny. The Hacker News front page was MiniMax, Wine on OpenBSD, and Timestral. The operator record is GHSA-953h-535j-jg2v, published at 16:53 UTC on 19 October. Agent Router's MCP proxy writes the caller's subject into the session identifier and then drops it on resume.

Medium Medium because GitHub labels it medium and CVSS 4.0 is 6.8. The impact text on that page says a resumed session can keep calling tools.

The resume path drops the subject.#

GHSA-953h-535j-jg2v is the primary. GitHub reviewed it at 16:53:26 UTC on 19 October. There is no CVE id. nvd_published_at is null. The package field is github.com/envoyproxy/ai-gateway, range >= 0.4.0-rc1, < 1.2.0-rc1, first patched version 1.2.0-rc1. CWE-798 and CWE-863. CVSS 4.0 is 6.8, vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N. There is no CVSS 3.1 vector on the record.

The session identifier is built to carry the authenticated caller's subject, which is the MCP guidance the advisory cites for session hijacking. On resume, the parser keeps the route and the backend session and discards the subject. Nothing compares that subject to the caller on the request. The advisory credits reporters aeonframework, PraveenKumarInjam, and kanywst. The remediation developer is nacx. GitHub's profile for nacx is Ignasi Barrera, a maintainer of the project.

The aggravating factor is the Helm chart. Through v1.1.0, controller.mcp.sessionEncryption.seed shipped as a fixed literal, with a comment that production should replace it. v1.2.0's values file leaves that seed empty and says the chart generates a random one, stores it in a Secret named <controller fullname>-mcp-session-encryption, and reuses it on upgrade.

The repository is theagentrouter/agent-router. The module line on main is still module github.com/envoyproxy/ai-gateway. The v1.2.0 notes call this the first release under the name Agent Router, formerly Envoy AI Gateway, and say the API group, the CRDs, and the Helm chart names are unchanged.

Two clocks, one release note.#

Pull request 2740, "mcp: take into account the request subject when resuming MCP sessions," merged at 13:57:40 UTC on 28 September. Merge commit 0d1e730. Pull request 2755, the random seed, merged at 14:46:22 UTC the same day, 48 minutes and 42 seconds later. Merge commit 99457966. Author aeonframework.

Compare against the tags: both commits are ancestors of v1.2.0-rc1 and of v1.2.0. Neither is an ancestor of v1.1.0 (the compare is ahead, behind zero). This brief did not bisect whether 0.4.0-rc1 already embedded the subject. That tag is the floor the advisory states. GitHub published it at 21:31 UTC on 5 November 2025.

GitHub release v1.1.0 published at 18:23 UTC on 21 August 2026. The module index records that version at the commit time 17:32 UTC the same day. v1.2.0-rc1 published at 08:40 UTC on 6 October. v1.2.0's tag commit is 17:41 UTC on 6 October, which is the time the module index records. The GitHub release published at 11:58:00 UTC on 7 October. From that release to the advisory is 12 days, 4 hours, and 55 minutes. From the subject-check merge to the advisory is 21 days, 2 hours, and 55 minutes.

1. 2025-11-05
   GitHub publishes v0.4.0-rc1. The advisory's affected range starts at this tag. Not bisected here.
2. 2026-08-21
   v1.1.0 ships. The chart still has a fixed session seed. The subject-check commit is not in this tag.
3. 2026-09-28
   PR 2740 merges at 13:57 UTC. PR 2755 merges at 14:46 UTC and generates a random seed.
4. 2026-10-07
   v1.2.0's GitHub release publishes at 11:58 UTC. The notes explain the seed and invite the old default back.
5. 2026-10-19
   GHSA-953h-535j-jg2v publishes at 16:53 UTC. No CVE id.

What the 6.8 does not say.#

The vector is local, passive user interaction, high confidentiality, integrity none, availability none. The impact paragraph says an attacker who obtains another user's session identifier, or who builds one because the default seed is public, can resume that user's backend session and invoke further methods on it. Those two sentences are the same advisory. A ticket that copies only VI:N will understate the tool calls. A ticket that rewrites the score to network critical will not match what GitHub displays.

v1.2.0 is 46 days and 17 hours after v1.1.0. Anyone who upgraded on 7 October and followed the "keep sessions" step has been on the new subject check with the old seed since then. Anyone still on v1.1.0 has neither change. The advisory does not name a customer incident.

What to do.#

1. Install v1.2.0 or later if the running chart is older than 1.2.0-rc1. Confirm the binary's module version, github.com/envoyproxy/ai-gateway, not the repository display name alone.
2. Leave the generated seed in place. If the upgrade values still set the previous chart default, replace that seed and expect clients to re-initialize. The v1.2.0 notes already describe a Secret you supply yourself for GitOps. Use a new value.
3. Find the Secret <controller fullname>-mcp-session-encryption and see whether its seed is the old literal. That file is the package clock you can check without a CVE.
4. Treat MCP session identifiers as bearer material until the subject check is in the build you run. The identifier is the credential the resume path accepts.
5. File this against the GitHub advisory, not a CVE feed. The record has no CVE id, and the release notes from 7 October will not alert a scanner that keys on CVE identifiers.