Google OSS Agent Mesh (SAM): Missing authentication in /libp2p-http ingress

Summary

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 contain missing authentication and authorization checks in the /libp2p-http ingress server of sam-node. An unauthenticated remote libp2p peer can bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services, including command-based MCP servers, A2A services and inference endpoints. The attack requires only that the ingress accepts a connection from the attacker's peer; no credentials are needed.

Affected

• Google SAM 0.1.0-alpha.1 to 0.1.0-alpha.2
• Default configuration: unaffected (per CNA record)
• Versions after 0.1.0-alpha.2 are not affected per the CNA range; later module versions were not checked in detail.

Fixed in

• Fixed in 0.1.0-alpha.3 (commit 433bc99d, "Fix security gap in HTTP Datapath ingress and proxy token leak").
• Module renamed to github.com/google/agentmesh after v0.1.0-rc.9; verify the fixed release on the vendor's release page.

Workaround

• Unknown. No vendor workaround was identified.
• Interim measure (not from the vendor): restrict which libp2p peers can reach the node and do not expose the ingress port to the internet or untrusted peers.

Exploitation

• CISA SSVC: exploitation status poc, automatable yes, technical impact total.
• No confirmed exploitation in the wild found; not known to be listed as known exploited (KEV not checked directly).
• VulDB states no public exploit is available; one reference tag mentions "exploit" and should be checked in the advisory.

Our recommendation

• Identify all SAM deployments and check lockfiles, container images and binaries for versions 0.1.0-alpha.1 and 0.1.0-alpha.2.
• Upgrade to 0.1.0-alpha.3 or later, preferably the newest release after checking the vendor's release page.
• Restrict libp2p peer access and keep the ingress port off the internet.
• Review logs for unexpected ingress traffic and rotate secrets and tokens accessible to MCP backends or inference endpoints.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub commit 433bc99d (fix) github.com
• GitHub release v0.1.0-alpha.3 github.com
• GitHub Security Advisory GHSA-r6hp-67wp-c7jx github.com
• Mirror advisory GHSA-r6hp-67wp-c7jx (agentmesh) github.com
• VulDB entry 422240 vuldb.com
• Go module sam v0.1.0-alpha.3 pkg.go.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:17.