Tools AI Risk Radar ai-incident-0229
Incident record
AI Gateway session flaw allowed another user’s tool calls
- Severity
- High
- Status
- Patched
- Type
- Infra Vuln
- Target
- Envoy AI Gateway MCP proxy
- Actor
- researcher
What happened
An attacker who obtained another user’s session identifier could resume that user’s backend MCP session. The public default encryption seed also allowed session identifiers to be forged.
The maintainer advisory describes cross-user access to tool calls and resource reads. It covers versions from 0.4.0-rc1 to before 1.2.0-rc1 and lists 1.2.0-rc1 as fixed. The reproduction is a code-level review rather than a test against a live cluster.
Sources
- Maintainer security advisorygithub.com/theagentrouter/agent-router/security/advisories/G…
- GitHub reviewed advisorygithub.com/advisories/GHSA-953h-535j-jg2v
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026