PT-2026-23611 · Unknown · Agentgateway

Spacewander · Publicado 2026-03-05 · Atualizado 2026-03-07 · CVE-2026-29791

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Agentgateway versions prior to 0.12.0

Description Agentgateway, an open source data plane for agentic AI connectivity, has an issue where input path, query, and header values are not sanitized when converting MCP tools/call requests to OpenAPI requests. This allows for the injection of additional path or query parameters and headers. The issue impacts usage of the MCP to OpenAPI feature.

Recommendations Upgrade to version 0.12.0 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2026-29791

GHSA-V2X6-WWFW-R2RQ

Produtos afetados

Agentgateway

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29791.json · Exploit
• https://github.com/agentgateway/agentgateway/security/advisories/GHSA-v2x6-wwfw-r2rq · Aviso do Fabricante
• https://github.com/agentgateway/agentgateway/commit/9a5287569d892e77a8be8c3bb7bf3d7744244274 · Nota
• https://github.com/agentgateway/agentgateway · Nota
• https://osv.dev/vulnerability/GHSA-v2x6-wwfw-r2rq · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-29791 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2030385161242636417 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-29791 · Nota de Segurança
• https://t.me/CVEtracker/46644 · Publicação no Telegram