Missing Authorization Vulnerability in Google OSS Agent Mesh

CVE-2026-103091

What is CVE-2026-103091?

The Google OSS Agent Mesh is affected by a significant flaw related to missing authorization and insecure default initialization. This vulnerability allows remote attackers to unknowingly self-enroll into the mesh, gaining unrestricted access to invoke arbitrary tools on all connected MCP backend nodes. The issue arises from the publicly disclosing OIDC configuration via the GET /info endpoint and the POST /register endpoint, which automatically enrolls valid OIDC token holders without proper claim filtering or ban checks. With a default policy that binds 'sam:system:authenticated' to wildcard services, an attacker can easily obtain mesh credentials, resulting in full read, write, and execution privileges on backend services. Users are advised to upgrade to version 0.1.0-alpha.9 or later to enforce stricter security measures, including a fail-closed default policy and explicit policy-binding requirements on user enrollment, supplemented by necessary ban checks.

References