Agent Router: MCP session hijacking via unchecked subject and default seed

Upgrade to Agent Router 1.2.0 (released 2026-10-07). It includes #2740 (subject check) and #2755 (random seed in the Helm chart).

1. Upgrade the controller, the extproc image and the ai-gateway-helm chart to 1.2.0. Upgrading changes the seed, which ends active MCP sessions; clients must initialize again.
2. If you set controller.mcp.sessionEncryption.fallback.seed=default-insecure-seed to keep sessions alive during the upgrade, remove it as soon as clients have reconnected. While it is set, the gateway still accepts session IDs encrypted with the public seed.
3. If you render the chart with helm template (GitOps), set controller.mcp.sessionEncryption.existingSecret or a long random seed. Otherwise every render makes a new seed.
4. If you run the controller or extproc outside the chart, always pass --mcpSessionEncryptionSeed with a secret random value. The binaries still default to default-insecure-seed; 1.2.0 only logs a warning.
5. Until you can upgrade, set controller.mcp.sessionEncryption.seed to a long random value. This stops forging, but a leaked session ID can still be reused by another user until you run 1.2.0.

The MCP proxy in Agent Router gives each client an encrypted Mcp-Session-Id. Inside it, the gateway stores the route, the backend MCP session IDs and the caller's subject (the JWT sub claim). The subject is there to stop session hijacking, as the MCP security best practices ask. But before 1.2.0 the resume path threw the subject away and never compared it with the current caller. On top of that, the official Helm chart shipped the public value default-insecure-seed as the key seed, so anyone could decrypt observed session IDs and build new ones.

Agent Router, formerly Envoy AI Gateway (Go module github.com/envoyproxy/ai-gateway, Helm chart ai-gateway-helm), 1.1.0 and earlier, with an MCPRoute in use. Fixed in 1.2.0 (2026-10-07). The cross-user risk matters most on routes with an OAuth/JWT securityPolicy, where several users share one gateway. Routes without OAuth have no subject, so their sessions were never tied to a user. Reviewed at commit 472da7d (2026-09-10).

• (a) No subject check on resume. Any authenticated user who got hold of another user's Mcp-Session-Id (from logs, a proxy, a shared tool, a browser) could send it with their own token. The gateway decrypted it and forwarded the request on the other user's already-initialized backend MCP sessions: tools/call, resources/read and other JSON-RPC methods ran in that user's context.
• (b) Public default seed. The AES-GCM key is derived with PBKDF2 from the seed and a salt that travels inside the session ID. With the chart default default-insecure-seed (and the default 100,000 iterations), anyone can decrypt an observed session ID, read the backend session IDs and subject inside, and encrypt a new one for any subject and backend session they choose.
• (c) Both together. With the default seed, the subject check alone is not enough: an attacker can decrypt a captured session ID and re-encrypt it with their own subject. That is why 1.2.0 fixes both parts.

On a multi-tenant gateway this crosses the exact user boundary the subject was added to protect. A working exploit is withheld.

Permalinks at 780fcf4, the parent of the fix commit.

• Subject parsed and dropped ("not needed during parsing"): internal/mcpproxy/session.go#L745-L802
• Session resumed from the decrypted ID alone, with no caller subject: internal/mcpproxy/mcpproxy.go#L298-L331
• The three resume call sites (GET, DELETE, POST): legacy.go#L133, legacy.go#L167, legacy.go#L216
• Subject read only at session creation: legacy.go#L307 and embedded at session.go#L808-L824
• Helm default seed: "default-insecure-seed": manifests/charts/ai-gateway-helm/values.yaml#L299, passed to the controller at templates/deployment.yaml#L119
• Same default in the binaries: cmd/controller/main.go#L270 and cmd/extproc/mainlib/main.go#L146
• Key derived only from the seed and the salt carried in the ID: internal/mcpproxy/crypto.go#L46-L49

• #2740 (commit 0d1e730, by the maintainer): backendSessionIDs() now returns the embedded subject, and sessionFromID rejects the request with 401 when it does not match the current caller's verified subject. It also adds a startup warning when the extproc runs with the public default seed.
• #2755 (commit 9945796, written by Aeon): when seed is empty (the new default), the chart generates a random 64-character seed on install, stores it in the Secret <controller fullname>-mcp-session-encryption, and reuses it on upgrade. A new existingSecret value supports helm template setups.
• Both are in 1.2.0, and both are still present on main at f4571d6 (2026-10-09).

• Check whether you ran with the public seed: look for --mcpSessionEncryptionSeed=default-insecure-seed in the controller Deployment, or -mcpSessionEncryptionSeed default-insecure-seed in the extproc container args of your gateway pods. If so, treat any MCP session ID that was ever exposed as readable by others.
• On 1.2.0, the extproc logs a warning that the seed is the well-known default if it still is, and resume attempts with a session ID issued to another subject fail with 401 and session ID was issued for a different authenticated subject.
• Before 1.2.0, if your access logs record both the Mcp-Session-Id and the JWT subject, look for one session ID used with more than one subject.

1. 2026-09-12Reported privately via GitHub PVR (GHSA-953h-535j-jg2v), with a suggested fix. Other researchers reported the same issue in parallel.
2. 2026-09-25Maintainer opens #2740 (subject check on resume).
3. 2026-09-28#2740 merged. The seed part, split out as agreed in the advisory discussion, is merged the same day as #2755, written by Aeon.
4. 2026-10-07Agent Router 1.2.0 released with both fixes; the maintainer publishes GHSA-953h-535j-jg2v.
5. 2026-10-09Public write-up. We asked the maintainer to request a CVE from GitHub in #2828.

Finder: Aaron Elijah Mars of Aeon. Tool: Aeon.

Also credited on the advisory as reporters: PraveenKumarInjam and kanywst. Fix in #2740 by nacx.

• Fix PRs (merged 2026-09-28): theagentrouter/agent-router#2740, theagentrouter/agent-router#2755
• Fixed release: Agent Router 1.2.0
• GitHub advisory: GHSA-953h-535j-jg2v
• CVE: not assigned yet; we asked the maintainer to request one from GitHub in #2828
• Related advisory: GHSA-r86v-rw5r-2cpj (MCP session seed passed as a literal container argument)
• MCP spec guidance: Session hijacking
• Affected repository: theagentrouter/agent-router