Google OSS Agent Mesh (SAM): Missing authorization and insecure default policy allow mesh takeover
Summary
Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 contain an insecure default policy and missing authorization in the MCP proxy and the OIDC enrollment flow. An attacker with any valid token from the configured OIDC provider can self-enroll into the mesh and invoke arbitrary tools on all connected MCP backend nodes, with read, write and execution access. The unauthenticated /info endpoint discloses the OIDC configuration needed to obtain such a token, so an externally reachable control plane is the main precondition.
Affected
- Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 through 0.1.0-alpha.8
- Default deployment configuration with policy sam:system:authenticated bound to wildcard services and targets
Fixed in
- Upgrade to version 0.1.0-alpha.9 or later (fixed according to the vendor and the CVE record)
Workaround
No vendor-documented interim workaround. Unknown.
Exploitation
- CISA SSVC: Exploitation 'poc', Automatable 'no', Technical Impact 'total'
- Public proof of concept: Unconfirmed
- CISA KEV: not listed
- In-the-wild exploitation: Unknown
Our recommendation
- Upgrade all SAM installations to version 0.1.0-alpha.9 or later.
- After the upgrade, review the policy and remove bindings of sam:system:authenticated to wildcard services or targets, as an upgraded deployment may keep the old policy.
- Check whether the control plane endpoints /info and /register are reachable from the internet and restrict access.
- Restrict which identities can obtain tokens from the OIDC issuer used by the mesh, and disable open self-registration if possible.
- Monitor enrollments and tool invocations for unknown nodes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub release v0.1.0-alpha.9 github.com
- GitHub Security Advisory GHSA-cgmg-9xf6-rrgw github.com
- NVD mirror (Vulners) CVE-2026-103091 vulners.com
- CVELIST record (Vulners) CVE-2026-103091 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:17.
Original description (NVD)
Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes. Because GET /info publicly discloses OIDC configuration, POST /register auto-enrolls any valid OIDC token holder without claim filtering or ban checks, and the default policy binds sam:system:authenticated to wildcard services and targets, an attacker can obtain a mesh credential with full read, write, and execution access on backend services. Users should upgrade to version 0.1.0-alpha.9 or later, which enforces a fail-closed default policy, explicit policy-binding requirements on enrollment, and ban checks.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.