Skip to content
OpenAdvisories
Medium · 4.9 CVE-2026-29791 EUVD-2026-10070GHSA-v2x6-wwfw-r2rq

Agentgateway: Missing parameter sanitization in MCP to OpenAPI conversion

Published Mar 6, 2026 · Updated Mar 9, 2026 · Assigned by GitHub_M

Description

Agentgateway is an open source data plane for agentic AI connectivity within or across any agent framework or environment. Prior to version 0.12.0, when converting MCP tools/call request to OpenAPI request, input path, query, and header values are not sanitized. This issue has been patched in version 0.12.0.

Affected products

VendorProductAffectedFixed
agentgateway agentgateway < 0.12.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/agentgateway/agentgateway < 0.12.0 0.12.0 GHSA-v2x6-wwfw-r2rq

References