agent-router: MCP session resumption does not validate the embedded anti-hijacking principal, and the Helm default seed makes session IDs forgeable

Envoy AI Gateway's agent-router was disclosed to have a session hijacking vulnerability: the MCP session resumption path does not validate the caller principal embedded in the session ID, and any client that obtains a session ID can resume the session as that user and call the backend MCP server. Affected versions are 0.4.0-rc1 to before 1.2.0-rc1, and it has been fixed in 1.2.0-rc1. The advisory states that the official Helm chart by default uses the public fixed seed default-insecure-seed, based on which an attacker can decrypt or forge session IDs; it recommends passing the current request principal in sessionFromID and comparing it, returning 401/403 when it does not match, and changing the default seed to be randomly generated on each installation. The advisory's reproduction is code-level and was not run on a real cluster.