Organizations at Risk: Google Agent Mesh SAM Alpha Flaws Enable Remote Tool Execution on Backend Nodes

Google Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.8 contain a critical security flaw that allows remote attackers to bypass authorization controls. The vulnerability stems from missing authorization checks and insecure default initializations within the MCP proxy and OIDC registration flow components. According to the National Vulnerability Database, the issue carries a CVSS score of 9.3, classifying it as critical severity.

How it unfolded

• The flaw was identified in the HandleStreamPassThrough function within mcp_service.go and the OIDC registration endpoints in internal/controlplane/server.go.
• The GET /info endpoint publicly disclosed OIDC configuration details, allowing attackers to gather necessary information for exploitation without authentication.
• The POST /register endpoint automatically enrolled any holder of a valid OIDC token, skipping claim filtering and ban checks due to insecure defaults.

Who is affected

Organizations using Google OSS Agent Mesh SAM versions prior to 0.1.0-alpha.9 are directly affected by this vulnerability. The NVD record confirms that versions 0.1.0-alpha.1 through 0.1.0-alpha.8 are vulnerable. The issue allows a remote attacker to self-enroll into the mesh. Once enrolled, the attacker can invoke arbitrary tools across all connected MCP backend nodes. The default policy binds authenticated users to wildcard services, granting full read, write, and execution access.

Our take on the response

Google has addressed the vulnerability by releasing version 0.1.0-alpha.9. This update enforces a fail-closed default policy, requiring explicit policy bindings for enrollment. It also introduces ban checks to prevent unauthorized access. The patch resolves the missing authorization and insecure default initialization weaknesses identified in the earlier alpha builds. Users are advised to upgrade to this version or later to mitigate the risk of unauthorized tool execution and mesh enrollment.

Who needs to act first

Managed service providers should prioritize updating systems exposed to untrusted networks or external users. Teams usually begin by inventorying all instances of the affected software to determine scope. It is advisable to test the update in a non-production environment first to ensure compatibility with existing configurations. Backing up current settings before applying the patch helps prevent operational disruptions. If immediate patching is not possible, restricting network access to the affected endpoints can reduce exposure while a fix is deployed.

What to do and how to stay safe: Google

• Verify current versions of Google Agent Mesh SAM across all managed environments to identify any instances running versions prior to 0.1.0-alpha.9.
• Apply the update to version 0.1.0-alpha.9 or later as soon as possible to enforce the new fail-closed default policies and enrollment checks.
• Monitor logs for any unusual enrollment attempts or unauthorized tool executions, particularly from external or untrusted sources.
• Review network access controls to ensure that OIDC registration endpoints are not publicly accessible to untrusted networks.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-103091 with a CVSS score of 9.3, which is classified as critical severity.

Which versions of Google Agent Mesh SAM are vulnerable?

Versions 0.1.0-alpha.1 through 0.1.0-alpha.8 are affected by this missing authorization and insecure default initialization flaw.

Does a patch exist for this vulnerability?

Yes, Google has released version 0.1.0-alpha.9, which includes fixes for the authorization bypass and insecure default settings.