CVE-2026-103091: Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)
Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcpservice.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes. Because GET /info publicly discloses OIDC configuration, POST /register auto-enrolls any valid OIDC token holder without claim filtering or ban checks, and the default policy binds sam:system:authenticated to wildcard services and targets, an attacker can obtain a mesh credential with full read, write, and execution access on backend services. Users should upgrade to version 0.1.0-alpha.9 or later, which enforces a fail-closed default policy, explicit policy-binding requirements on enrollment, and ban checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google OSS Agent Mesh (SAM)to a version that resolves this vulnerability.Fixed in 0.1.0-alpha.9
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 are affected when their MCP proxy and enrollment endpoints are reachable by a remote attacker. All connected MCP backend nodes may be exposed because the default policy grants authenticated mesh identities wildcard access to services and targets.
What does an attacker need to exploit it?
An attacker needs network access to the exposed SAM endpoints and a valid OIDC token. No existing mesh account, special claims, user interaction, or prior authorization is required because registration accepts valid token holders without claim filtering or ban checks.
What is the practical impact after enrollment?
The attacker can self-enroll, obtain a mesh credential, and invoke arbitrary tools across connected MCP backend nodes. The vulnerable default policy can provide full read, write, and execution access on backend services.
What should be done if an immediate upgrade is not possible?
The provided data does not specify a complete workaround. Prioritize restricting remote access to the MCP proxy and OIDC enrollment endpoints, and avoid relying on the vulnerable default policy; the documented remediation is upgrading to 0.1.0-alpha.9 or later.
How can I tell whether my deployment is affected?
Check whether SAM is running a version from 0.1.0-alpha.1 through 0.1.0-alpha.8 and whether GET /info and POST /register are exposed. Affected deployments use the insecure default policy and permit enrollment for any valid OIDC token holder without explicit policy binding or ban checks.