cve.bz

CVE-2026-29791

6.5 mediumEPSS 0.2%

Medium (6.5) in lfprojects agentgateway. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/agentgateway/agentgateway 0.12.0.

Agentgateway is an open source data plane for agentic AI connectivity within or across any agent framework or environment. Prior to version 0.12.0, when converting MCP tools/call request to OpenAPI request, input path, query, and header values are not sanitized. This issue has been patched in version 0.12.0.

Severity

CVSS 3.1

6.5 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS
0.2% chance of exploitation in the next 30 days; higher than 4% of CVEs (scores of 2026-10-31)
CWE
CWE-20
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-v2x6-wwfw-r2rqGogithub.com/agentgateway/agentgateway<0.12.00.12.0

References

Check your stackJSON