CVE-2026-29791: 
Agentgateway vulnerability analysis and mitigation

CVE-2026-29791 is an improper input validation vulnerability in Agentgateway, an open-source data plane for agentic AI connectivity. Prior to version 0.12.0, input path, query, and header values are not sanitized when converting MCP (Model Context Protocol) tools/call requests to OpenAPI requests. The vulnerability was published on March 6, 2026, with a patch released in version 0.12.0. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-20 (Improper Input Validation). During the conversion of MCP tool/call requests to OpenAPI requests, the gateway fails to sanitize user-supplied values in path parameters, query parameters, and HTTP headers before forwarding them to downstream services. This network-accessible flaw requires no authentication and no user interaction, allowing an attacker to craft malicious MCP tool requests with injected values that are passed unsanitized into outbound OpenAPI calls (GitHub Advisory, Red Hat CVE).

Successful exploitation can result in request manipulation affecting both confidentiality and integrity of data processed by Agentgateway and connected downstream systems. Attackers may be able to bypass security controls, inject malicious values into forwarded API requests, or manipulate data in systems connected via the gateway's OpenAPI integration. Availability is not directly impacted, but the ability to tamper with inter-service communication in agentic AI environments could have significant downstream consequences (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.04%, indicating a low probability of exploitation in the near term (Red Hat CVE, GitHub Advisory).

1. Reconnaissance: Identify Agentgateway instances running versions prior to 0.12.0 that expose MCP tool/call endpoints, using network scanning or service discovery tools.
2. Craft malicious MCP request: Construct an MCP tools/call request with injected payloads embedded in path segments, query parameters, or HTTP header values (e.g., path traversal sequences, header injection newlines, or parameter pollution strings).
3. Submit request to gateway: Send the crafted MCP request to the Agentgateway endpoint responsible for converting MCP tool calls to OpenAPI requests.
4. Observe forwarded request: The gateway forwards the unsanitized values directly into the outbound OpenAPI request, potentially manipulating the target API's behavior, bypassing access controls, or exfiltrating data from connected backend services (GitHub Advisory).

• Network: Unusual or malformed MCP tool/call requests containing path traversal sequences (../), CRLF injection characters (%0d%0a), or unexpected special characters in query or header fields forwarded to downstream OpenAPI endpoints.
• Logs: Agentgateway access logs showing MCP tool conversion requests with anomalous parameter values; downstream API logs reflecting unexpected path, query, or header values not originating from legitimate clients.
• Process/Behavior: Unexpected responses or errors from downstream OpenAPI services triggered by malformed forwarded requests; unusual data access patterns in systems connected to the gateway.

Upgrade Agentgateway to version 0.12.0 or later, which includes the fix for missing parameter sanitization in MCP-to-OpenAPI conversion. As an interim measure, restrict access to MCP tool/call endpoints to only trusted and authenticated users, and implement network-level controls to limit exposure of the gateway. Monitor gateway logs for suspicious MCP tool conversion requests with unusual path, query, or header parameters (GitHub Advisory, Red Hat CVE).

The advisory was published by maintainer howardjohn on GitHub on March 4, 2026, and rated as Moderate severity. Coverage has been limited to automated vulnerability tracking services and security feed aggregators, with no notable researcher commentary or significant media coverage identified at this time (GitHub Advisory).