CVE-2026-103091
Received Received - Intake

Authorization Bypass in Google OSS Agent Mesh

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Google Inc.

Description
Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes. Because GET /info publicly discloses OIDC configuration, POST /register auto-enrolls any valid OIDC token holder without claim filtering or ban checks, and the default policy binds sam:system:authenticated to wildcard services and targets, an attacker can obtain a mesh credential with full read, write, and execution access on backend services. Users should upgrade to version 0.1.0-alpha.9 or later, which enforces a fail-closed default policy, explicit policy-binding requirements on enrollment, and ban checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-103091
EUVD
EUVD-2026-104050

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Google SAM 0.1.0-alpha.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves missing authorization checks and insecure default settings in Google OSS Agent Mesh (SAM). It allows remote attackers to self-enroll into the mesh and execute arbitrary tools across connected MCP backend nodes. The issue stems from two unauthenticated HTTP endpoints: GET /info exposes OIDC configuration, and POST /register auto-enrolls any valid OIDC token without validation. The default policy grants full access to all authenticated users.

Detection Guidance

Check for unauthorized enrollment attempts by monitoring POST /register requests in your OIDC logs. Inspect GET /info responses for exposed OIDC configuration details. Verify if any MCP tools are accessible without proper authorization checks.

Impact Analysis

An attacker can exploit this to gain full read, write, and execution access on all backend MCP services. This includes exfiltrating sensitive data, stealing credentials, and taking over systems. The attack requires no special privileges and can be executed remotely with low complexity.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection (GDPR) and healthcare data (HIPAA) due to unauthorized access to sensitive systems and data. It enables full confidentiality, integrity, and availability breaches, which are critical violations for these standards.

Mitigation Strategies

Upgrade to SAM version 0.1.0-alpha.9 or later to enforce fail-closed policies and ban checks. Disable auto-enrollment in POST /register and validate OIDC tokens with claim filtering. Restrict default policy bindings to prevent wildcard access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103091. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart