Agentgateway allows external systems to convert MCP tool calls into OpenAPI requests. In versions earlier than 0.12.0, the conversion process fails to sanitize input values for path segments, query parameters, and headers, creating a classic input validation flaw (CWE‑20). An attacker who can supply crafted MCP calls may cause the generated OpenAPI request to contain malformed or malicious values, potentially leading to unintended API behavior, information disclosure, or denial of service.

All installations of Agentgateway older than version 0.12.0. The affected product is the open‑source data plane component named Agentgateway, as listed by the CNA vendor product pair agentgateway:agentgateway. No other vendor or product variants are referenced in the advisory.

The CVSS score of 4.9 indicates a moderate risk, and the EPSS score of less than 1% suggests the likelihood of real‑world exploitation is very low at present. The vulnerability is not currently listed in the CISA KEV catalog, further indicating limited exploitation activity. If an attacker can reach the MCP interface, they can manipulate the OpenAPI request generation, though this does not immediately grant arbitrary code execution. The principal risk lies in accidental or malicious alteration of downstream API requests.