{"id":"CVE-2026-103091","kind":"vulnerability","aliases":["CVE-2026-103091"],"related":[],"title":"Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP…","description":"Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes. Because GET /info publicly discloses OIDC configuration, POST /register auto-enrolls any valid OIDC token holder without claim filtering or ban checks, and the default policy binds sam:system:authenticated to wildcard services and targets, an attacker can obtain a mesh credential with full read, write, and execution access on backend services. Users should upgrade to version 0.1.0-alpha.9 or later, which enforces a fail-closed default policy, explicit policy-binding requirements on enrollment, and ban checks.","summary":"Google SAM (Sovereign/OSS Agent Mesh) before 0.1.0-alpha.9: GET /info is unauthenticated and leaks OIDC config, POST /register auto-enrolls anyone with a valid token from the configured OIDC provider (no claim filtering, no ban check), and the shipped default policy binds sam:system:authenticated to wildcard services and targets. An enrolled attacker can invoke any tool on any MCP backend node (read/write/exec). A one-hour OIDC token yields a 90-day credential, and bans are bypassed by regenerating the keypair. The vendor advisory scores it CVSS 3.1 9.8. NVD lists alpha.1 to alpha.8 and applies to default config; custom restrictive policy bindings reduce impact.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"google/sam (Agent Mesh)","fixed":["0.1.0-alpha.9"],"affected":"< 0.1.0-alpha.9","ecosystem":"go"}],"ecosystems":["go"],"tags":["agent-mesh","ai-tooling","mcp","oidc","sam","self-hosted"],"not_affected_if":["control-plane-not-reachable","default-config-changed","not-on-alpha-1-to-alpha-8"],"how_to_check":"Vendor gives no detection steps. Suggested: check the control plane version (go.mod github.com/google/sam or the running binary) is below v0.1.0-alpha.9; test whether GET <control-plane>/info answers without auth from outside; review your policy for sam:system:authenticated bound to wildcard services/targets; list enrolled nodes and /register logs for unknown identities; check your OIDC provider is not open to arbitrary sign-ups.","fix":"Upgrade to v0.1.0-alpha.9 (fail-closed default policy, explicit policy binding on enrollment, ban checks). Until then: restrict network access to the control plane, replace wildcard policy with least-privilege bindings, restrict the OIDC client to a scoped group/domain, and rotate secrets reachable from mesh backends and revoke enrolled credentials if exposure is suspected.","status":"open","published_at":"2026-10-19T03:16:58+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-23T22:08:51+00:00","updated_at":"2026-10-23T22:28:56+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T22:08:51Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Google OSS Agent Mesh (SAM) to 0.1.0-alpha.9 or later, which enforces a fail-closed default policy, explicit policy-binding requirements on enrollment, and ban checks.\nunknown","reach":"internet","impact":"high","summary":"Google Open Source Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 let a remote attacker with any valid OIDC token self-enroll into the mesh. The default policy then grants that enrollee wildcard access to invoke tools on all connected MCP backend nodes.","category":"ai-tooling","who_cares":["sam","mcp","agent-mesh","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker gains mesh credential and invokes arbitrary tools on backend services","analyst_note":"Check the NVD entry and Google SAM release notes for how to detect an exposed deployment, and confirm whether the default policy applies to all installs.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config-changed","not-on-alpha-1-to-alpha-8"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000528,"input_tokens":3024,"output_tokens":452,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and Google SAM release notes for how to detect an exposed deployment, and confirm whether the default policy applies to all installs.","search":"'-103091':21A,24A '-1188':15A,161C '-2026':20A,23A '-862':4A,150C '/info':49B,174C,215C '/register':57B,177C,221C '0.1.0':46B,187C,190C,271C '3.1':129B '9.8':130B '90':112B 'access':262C 'across':207C 'advisori':125B 'agent':26A,29B,43B,183C 'agent-mesh':28B 'ai':32B 'ai-tool':31B 'allow':192C 'alpha.1':133B,188C 'alpha.8':135B,191C 'alpha.9':47B,272C 'anyon':61B 'appli':137B 'arbitrari':205C 'attack':93B,195C,250C 'authent':85B,243C 'author':2A,148C 'auto':59B,223C 'auto-enrol':58B,222C 'backend':101B,211C,264C 'ban':75B,116B,234C,291C 'bind':82B,144B,240C,286C 'bypass':118B 'check':76B,235C,292C 'claim':72B,231C 'close':280C 'config':55B,140B 'configur':68B,219C 'connect':209C 'credenti':114B,255C 'custom':141B 'cve':19A,22A 'cvss':128B 'cwe':3A,14A,149C,160C 'day':113B 'default':13A,80B,139B,159C,238C,281C 'disclos':217C 'enforc':276C 'enrol':60B,92B,199C,224C,289C 'execut':261C 'explicit':283C 'fail':279C 'fail-clos':278C 'filter':73B,232C 'flow':172C 'full':257C 'get':48B,173C,214C 'googl':40B,181C 'google/sam':25A 'handlestreampassthrough':166C 'holder':229C 'host':39B 'hour':107B 'impact':146B 'initi':6A,152C 'insecur':12A,158C 'internal/controlplane/server.go':179C 'invok':95B,204C 'keypair':122B 'later':274C 'leak':53B 'list':132B 'mcp':18A,34B,100B,164C,210C 'mcp_service.go':168C 'mesh':27A,30B,44B,184C,202C,254C 'miss':1A,147C 'node':102B,212C 'nvd':131B 'obtain':252C 'oidc':35B,54B,69B,108B,170C,218C,227C 'one':106B 'one-hour':105B 'oss':182C 'polici':81B,143B,239C,282C,285C 'policy-bind':284C 'post':56B,176C,220C 'provid':70B 'proxi':165C 'public':216C 'read':258C 'read/write/exec':103B 'reduc':145B 'regener':120B 'registr':171C 'remot':194C 'requir':287C 'resourc':9A,155C 'restrict':142B 'sam':36B,41B,83B,185C,241C 'score':126B 'self':38B,198C 'self-enrol':197C 'self-host':37B 'servic':88B,246C,265C 'ship':79B 'sovereign/oss':42B 'system':84B,242C 'target':90B,248C 'token':65B,109B,228C 'tool':33B,97B,206C 'unauthent':51B 'upgrad':268C 'user':266C 'valid':64B,226C 'vendor':124B 'version':186C,270C 'wildcard':87B,245C 'without':230C 'write':259C 'yield':110B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T03:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@google.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103091","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103091","severity":null,"published_at":"2026-10-19T03:16:58+00:00","modified_at":"2026-10-19T21:13:39+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103091:174","url":null,"severity":null,"published_at":"2026-10-23T22:11:23+00:00","modified_at":"2026-10-23T22:11:23+00:00","first_seen_at":"2026-10-23T22:11:23+00:00","fetched_at":"2026-10-23T22:11:23+00:00","note":"Read vendor GHSA-cgmg-9xf6-rrgw (google/agentmesh, Sep 6 2026, reporter Noma Security) plus CVE record. Advisory gives no detection steps; how-to-check is derived guidance. Reporter PoC exists but no public link found; no exploitation reports found. Sibling SAM advisories: CVE-2026-103090 (GHSA-hp3x-79wr-rx66), CVE-2026-102503 (GHSA-r6hp-67wp-c7jx, fixed alpha.3). Did not search social."}],"documents":[{"id":1313,"url":"https://github.com/google/agentmesh/security/advisories/GHSA-cgmg-9xf6-rrgw","title":"GHSA-cgmg-9xf6-rrgw: Insecure default policy and unrestricted enrollment in SAM","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1320,"url":"https://www.cve.org/CVERecord?id=CVE-2026-103091","title":"CVE Record CVE-2026-103091","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}