| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/agentgateway/agentgateway | < 0.12.0 | 0.12.0 |
| agentgateway | < 0.12.0 | 0.12.0 |
When converting MCP tools/call request to OpenAPI request, input path, query, and header values are not sanitized.
When using the MCP to OpenAPI feature, the proxy lacks proper sanitization of input parameters in the MCP call, allowing:
This vulnerability is fixed in Agentgateway v0.12.0+. Users on older versions are recommended to upgrade to v0.12.0+.
This feature only impacts usage of the MCP to OpenAPI feature
Agentgateway extends its thanks to @spacewander for the report!
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free