CVE-2026-102503: Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)
Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services (including command/stdio-backed MCP servers, A2A, and inference endpoints). While the MCP protocol stream handler enforces WithBiscuitAuth and Authorize checks, the parallel /libp2p-http ingress routes requests directly to backend service handlers without verifying a Biscuit token or mesh enrollment. Users should upgrade to version 0.1.0-alpha.3 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google OSS Agent Mesh (SAM)to a version that resolves this vulnerability.Fixed in 0.1.0-alpha.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 are affected when the /libp2p-http ingress server is in use. The affected ingress can route requests to registered backend services, including command/stdio-backed MCP servers, A2A, and inference endpoints.
What does an attacker need to exploit it?
An attacker needs only remote libp2p connectivity to the affected ingress. No authentication, Biscuit token, mesh enrollment, or prior privileges are required.
Does the existing Biscuit policy enforcement protect these requests?
No. Although the MCP protocol stream handler performs Biscuit authentication and authorization checks, the parallel /libp2p-http ingress routes requests directly to backend handlers without those checks.
How should this be remediated?
Upgrade SAM to version 0.1.0-alpha.3 or later. The provided information does not specify a workaround for deployments that cannot yet upgrade.