Cloudanix VulnDB

GHSA-4gph-2hhr-5mwg

Low · 3.7

Envoy AI Proxy - MCP Message Smuggling Vulnerability

CVSS

3.7

EPSS

—

Published

May 19, 2026

CISA due date

—

The record

Envoy AI Gateway was found to be affected by a protocol parser differential vulnerability due to improper implementation of the JSON-RPC 2.0 specification. Such differential causes a MCP message alteration, potentially causing a bypass of security controls in a multi-layered architecture. According to the JSON RPC Spec used by Model Context Protocol, JSON RPC should be case sensitive https://www.jsonrpc.org/specification ``` [...] All member names exchanged between the Client and the Server that are considered for matching of any kind should be considered to be case-sensitive. The terms function, method, and procedure can be assumed to be interchangeable. ``` The AI Gateway is accepting and processing case-variant fields that compliant MCP implementations correctly ignore. Crucially, Envoy does not just "pass through" the message by acting as a transparent proxy, it alters the traffic, allowing smuggling of unwanted requests. The following steps represent the incoming message alteration: 1. **Incoming MCP Message**: ``` { id: 1, jsonrpc: "2.0", method: "tools/call", params: { name: "backend__greet", Name: "backend__secretTool", arguments: { name: "World!" }, Arguments: { name: "Exploit" } } } ``` 2. **Parses** the request, picking the non-standard `Name` field over the authorized `name` field due to internal case-insentitive parsing by libraries such as `modelcontextprotocol/go-sdk/jsonrpc` and `github.com/bytedance/sonic` 3. **Overwrites** the authorized "backend__greet" value from the valid `name` field with the malicious value from the `Name` field 4. **Normalizes** the injected "backend__secretTool" value (from the invalid `Name` field) 5. **Re-serializes** the request into a new, valid MCP JRPC payload (`{"name": "backend__secretTool"}`) and forwards it upstream This "smuggling" effect means Envoy actively transforms a request that might have been checked by any prior MCP-compliant implementation into a request that is **valid and altered** (from the perspective of the upstream backend), effectively introducing protocol modifications that may allow bypassing any prior authorization layer.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities