github.com/envoyproxy/ai-gateway vulnerabilities (Go)

2 vulnerabilities.

• github.com/envoyproxy/ai-gateway Go agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable GHSA-953h-535j-jg2v Fix available 6.8 MediumOctober 19, 2026
• github.com/envoyproxy/ai-gateway Go Envoy AI Proxy - MCP Message Smuggling Vulnerability GHSA-4gph-2hhr-5mwg Fix available 6.3 MediumMay 19, 2026