---
id: "CVE-2026-103091"
kind: "vulnerability"
aliases: ["CVE-2026-103091"]
title: "Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP\u2026"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "google/sam (Agent Mesh)", "fixed": ["0.1.0-alpha.9"], "affected": "< 0.1.0-alpha.9", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["agent-mesh", "ai-tooling", "mcp", "oidc", "sam", "self-hosted"]
not_affected_if: ["control-plane-not-reachable", "default-config-changed", "not-on-alpha-1-to-alpha-8"]
published_at: "2026-10-19T03:16:58+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-23T22:28:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103091", "first_seen_at": "2026-10-23T21:57:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:11:23+00:00"}]
---

# Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP…

Google SAM (Sovereign/OSS Agent Mesh) before 0.1.0-alpha.9: GET /info is unauthenticated and leaks OIDC config, POST /register auto-enrolls anyone with a valid token from the configured OIDC provider (no claim filtering, no ban check), and the shipped default policy binds sam:system:authenticated to wildcard services and targets. An enrolled attacker can invoke any tool on any MCP backend node (read/write/exec). A one-hour OIDC token yields a 90-day credential, and bans are bypassed by regenerating the keypair. The vendor advisory scores it CVSS 3.1 9.8. NVD lists alpha.1 to alpha.8 and applies to default config; custom restrictive policy bindings reduce impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:google/sam (Agent Mesh) affected < 0.1.0-alpha.9 fixed 0.1.0-alpha.9

## How to check

Vendor gives no detection steps. Suggested: check the control plane version (go.mod github.com/google/sam or the running binary) is below v0.1.0-alpha.9; test whether GET <control-plane>/info answers without auth from outside; review your policy for sam:system:authenticated bound to wildcard services/targets; list enrolled nodes and /register logs for unknown identities; check your OIDC provider is not open to arbitrary sign-ups.

## Fix

Upgrade to v0.1.0-alpha.9 (fail-closed default policy, explicit policy binding on enrollment, ban checks). Until then: restrict network access to the control plane, replace wildcard policy with least-privilege bindings, restrict the OIDC client to a scoped group/domain, and rotate secrets reachable from mesh backends and revoke enrolled credentials if exposure is suspected.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103091
- 2026-10-23T22:11:23+00:00 analyst — Read vendor GHSA-cgmg-9xf6-rrgw (google/agentmesh, Sep 6 2026, reporter Noma Security) plus CVE record. Advisory gives no detection steps; how-to-check is derived guidance. Reporter PoC exists but no public link found; no exploitation reports found. Sibling SAM advisories: CVE-2026-103090 (GHSA-hp3x-79wr-rx66), CVE-2026-102503 (GHSA-r6hp-67wp-c7jx, fixed alpha.3). Did not search social.

## Documents

- [advisory] GHSA-cgmg-9xf6-rrgw: Insecure default policy and unrestricted enrollment in SAM https://github.com/google/agentmesh/security/advisories/GHSA-cgmg-9xf6-rrgw
- [describes] CVE Record CVE-2026-103091 https://www.cve.org/CVERecord?id=CVE-2026-103091

## From the sources

Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes. Because GET /info publicly discloses OIDC configuration, POST /register auto-enrolls any valid OIDC token holder without claim filtering or ban checks, and the default policy binds sam:system:authenticated to wildcard services and targets, an attacker can obtain a mesh credential with full read, write, and execution access on backend services. Users should upgrade to version 0.1.0-alpha.9 or later, which enforces a fail-closed default policy, explicit policy-binding requirements on enrollment, and ban checks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_