CVE-2026-29791CWE-20

Agentgateway: Missing parameter sanitization in MCP to OpenAPI conversion

Medium · published March 6, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
16.4
In the wild
Unconfirmed
What it is

Agentgateway is an open source data plane for agentic AI connectivity within or across any agent framework or environment. Prior to version 0.12.0, when converting MCP tools/call request to OpenAPI request, input path, query, and header values are not sanitized. This issue has been patched in version 0.12.0.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00256 · 16.4th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-03-06T20:39Z
EPSS history
Timeline
  • 06 MAR 20:39Z
    Agentgateway: Missing parameter sanitization in MCP to OpenAPI conversion
    cvelistv5