Envoy's AI Gateway contains a session hijacking vulnerability in its MCP proxy where session resume does not verify the embedded anti-hijacking subject, allowing attackers to hijack other users' sessions. The vulnerability is aggravated by the official Helm chart shipping a publicly known default seed for session encryption.
Disclosed 19 October 2026 · Record updated 19 October 2026
Attackers who obtain another user's MCP session ID can resume that session and invoke operations in the context of that user's backend session, crossing trust boundaries in multi-tenant deployments.
VulnerabilitiesA security advisory published on 19 October 2026 says the gateway never checks who owns a session on resume, and its Helm chart ships a publicly known encryption seed.
19 Oct 2026
