CVE-2026-103091 in Agent Mesh
Summary
by MITRE • 10/19/2026
Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes. Because GET /info publicly discloses OIDC configuration, POST /register auto-enrolls any valid OIDC token holder without claim filtering or ban checks, and the default policy binds sam:system:authenticated to wildcard services and targets, an attacker can obtain a mesh credential with full read, write, and execution access on backend services. Users should upgrade to version 0.1.0-alpha.9 or later, which enforces a fail-closed default policy, explicit policy-binding requirements on enrollment, and ban checks.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in Google OSS Agent Mesh (SAM) versions ranging from 0.1.0-alpha.1 through 0.1.0-alpha.8 represents a critical failure in access control mechanisms combined with insecure default configurations. This flaw is categorized under CWE-862, which denotes Missing Authorization, and CWE-1188, which refers to the Initialization of a Resource with an Insecure Default. These issues are present within two primary components: the MCP proxy function HandleStreamPassThrough located in mcp_service.go, and the OpenID Connect registration flow involving GET /info and POST /register endpoints found in internal/controlplane/server.go. The combination of these flaws allows for a severe compromise where remote attackers can bypass authentication boundaries to gain unauthorized access to sensitive resources within the mesh infrastructure.
The operational impact stems from how the system handles identity verification and policy enforcement during the enrollment process. Specifically, the GET /info endpoint publicly discloses OpenID Connect configuration details without requiring any form of authentication or authorization check. This exposure provides attackers with essential information regarding the OIDC provider's capabilities and endpoints, facilitating further exploitation attempts. More critically, the POST /register endpoint allows for self-enrollment into the mesh using any valid OIDC token holder credential. The system fails to implement claim filtering or ban checks during this registration process, meaning that an attacker possessing a legitimate but unauthorized identity can register themselves as a trusted member of the network without restriction.
Once enrolled, the attacker benefits from the default policy configuration which binds the sam:system:authenticated role to wildcard services and targets. This insecure default setting effectively grants any authenticated user full read, write, and execution access across all backend MCP nodes connected to the mesh. Consequently, a remote attacker can invoke arbitrary tools on these backend systems, leading to potential data exfiltration, system modification, or complete compromise of the underlying infrastructure. From an adversarial perspective, this aligns with ATT&CK techniques related to Initial Access via valid accounts and Lateral Movement through compromised credentials, as the attacker gains persistent foothold within the internal network architecture.
To mitigate these risks, it is imperative for users to upgrade immediately to version 0.1.0-alpha.9 or any later release of Google OSS Agent Mesh. The updated versions address the root causes by enforcing a fail-closed default policy, which ensures that access is denied unless explicitly permitted rather than granted by default. Furthermore, the new releases require explicit policy-binding during enrollment and implement necessary ban checks to prevent unauthorized identities from joining the mesh. These changes restore proper authorization controls and eliminate the insecure defaults that previously allowed unrestricted self-enrollment and broad system access for any authenticated user.