Google Agent Mesh up to 0.1.0-alpha.8 MCP Proxy mcp_service.go HandleStreamPassThrough authorization

Summaryinfo

A vulnerability classified as very critical has been found in Google Agent Mesh up to 0.1.0-alpha.8. This issue affects the function HandleStreamPassThrough of the file mcp_service.go of the component MCP Proxy. This manipulation causes authorization. The identification of this vulnerability is CVE-2026-103091. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Google Agent Mesh up to 0.1.0-alpha.8 and classified as very critical. Affected by this vulnerability is the function HandleStreamPassThrough of the file mcp_service.go of the component MCP Proxy. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes. Because GET /info publicly discloses OIDC configuration, POST /register auto-enrolls any valid OIDC token holder without claim filtering or ban checks, and the default policy binds sam:system:authenticated to wildcard services and targets, an attacker can obtain a mesh credential with full read, write, and execution access on backend services. Users should upgrade to version 0.1.0-alpha.9 or later, which enforces a fail-closed default policy, explicit policy-binding requirements on enrollment, and ban checks.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-103091 since 09/30/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 10/19/2026).

Upgrading to version 0.1.0-alpha.9 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Google

Name

• Agent Mesh

Version

• 0.1.0-alpha.0
• 0.1.0-alpha.1
• 0.1.0-alpha.2
• 0.1.0-alpha.3
• 0.1.0-alpha.4
• 0.1.0-alpha.5
• 0.1.0-alpha.6
• 0.1.0-alpha.7
• 0.1.0-alpha.8

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion