CVE-2026-29791
- Source
- https://cve.org/CVERecord?id=CVE-2026-29791
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29791.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-29791
- Aliases
- Published
- 2026-03-06T20:39:40.852Z
- Modified
- 2026-04-10T05:42:34.932179Z
- Severity
-
- 4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- Agentgateway: Missing parameter sanitization in MCP to OpenAPI conversion
- Details
-
Agentgateway is an open source data plane for agentic AI connectivity within or across any agent framework or environment. Prior to version 0.12.0, when converting MCP tools/call request to OpenAPI request, input path, query, and header values are not sanitized. This issue has been patched in version 0.12.0.
- Database specific
{ "cwe_ids": [ "CWE-20" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29791.json", "cna_assigner": "GitHub_M" }- References
Affected packages
Git / github.com/agentgateway/agentgateway
Affected ranges
- Type
- GIT
- Repo
- https://github.com/agentgateway/agentgateway
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
v0.*
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.1.0
v0.1.1
v0.1.2
v0.10.0
v0.10.1
v0.10.2
v0.10.3
v0.10.4
v0.10.5
v0.11.0
v0.11.0-alpha.1
v0.11.1
v0.11.2
v0.11.3
v0.2.0
v0.3.0
v0.4.0
v0.4.1
v0.4.10
v0.4.11
v0.4.12
v0.4.13
v0.4.14
v0.4.15
v0.4.16
v0.4.17
v0.4.18
v0.4.19
v0.4.2
v0.4.20
v0.4.21
v0.4.22
v0.4.23
v0.4.24
v0.4.25
v0.4.26
v0.4.27
v0.4.28
v0.4.29
v0.4.3
v0.4.30
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.4.9
v0.5.0
v0.5.1
v0.5.2
v0.6.0
v0.6.1
v0.6.2
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.7.8
v0.7.9
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.9.0