{"data":{"id":"8da3a996-3a03-4e2c-91b9-58f8550de463","title":"CVE-2026-29791: Agentgateway is an open source data plane for agentic AI connectivity within or across any agent framework or…","summary":"CVE-2026-29791 affects Agentgateway, an open source data plane for agentic AI connectivity, prior to version 0.12.0. When converting an MCP tools/call request to an OpenAPI request, input path, query, and header values are not sanitized, which is classified as CWE-20 Improper Input Validation. The NVD assessment has not yet been provided.","solution":"This issue has been patched in version 0.12.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-29791","publishedAt":"2026-03-06T21:16:15.787Z","cveId":"CVE-2026-29791","cweIds":["CWE-20"],"cvssScore":"4.9","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/agentgateway/agentgateway@< 0.12.0 (fixed: 0.12.0)"],"affectedPackageNames":["github.com/agentgateway/agentgateway"],"affectedPackageRefs":["go:github.com/agentgateway/agentgateway"],"affectedVendors":[],"affectedVendorsRaw":["Agentgateway"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Agentgateway input validation flaw in MCP tools/call to OpenAPI conversion","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00168,"epssCheckedAt":"2026-11-04T12:08:34.077Z","kevDateAdded":null,"advisoryAliases":["GHSA-v2x6-wwfw-r2rq"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:50:32.792Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2026-02-09T16:21:42.000Z","daysToFix":-25,"fixCheckedAt":"2026-10-29T21:40:07.678Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/agentgateway/agentgateway","fixedVersion":"0.12.0","matchedVersion":"v0.12.0","fixReleasedAt":"2026-02-09T16:21:42.000Z","daysToFix":-25,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:07.530Z"}]}}