Patch Google Agent Mesh to Stop Unauthenticated Remote Service Access
A critical flaw in early Google SAM builds allows remote peers to bypass security checks and trigger backend services without valid credentials.
Key points
- Google OSS Agent Mesh versions 0.1.0-alpha.1 through 0.1.0-alpha.2 contain a critical authentication bypass.
- Attackers can invoke arbitrary backend services, including inference endpoints, without Biscuit tokens.
- The vendor recommends upgrading to version 0.1.0-alpha.3 or later to resolve the issue.
Remote attackers can access sensitive backend services in Google’s Agent Mesh without proper authorization, according to a National Vulnerability Database record. This flaw allows unauthenticated peers to bypass security policies and trigger arbitrary functions within the mesh network.
The vulnerability, identified as CVE-2026-102503, carries a CVSS score of 9.3, which the NVD classifies as critical. It affects the /libp2p-http ingress server component within the software. The weakness stems from missing authentication for critical functions and missing authorization checks, categorized under CWE-306 and CWE-862.
Technical Context
The issue exists in the StartIngressServer function located in cmd/sam-node/node.go. While the standard MCP protocol stream handler enforces WithBiscuitAuth and Authorize checks, the parallel /libp2p-http ingress routes requests directly to backend service handlers. This routing occurs without verifying a Biscuit token or confirming mesh enrollment.
Affected Versions
The flaw impacts Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2. Any deployment using these specific alpha builds is vulnerable to remote exploitation. The NVD record indicates that versions prior to 0.1.0-alpha.3 are affected by this authentication bypass.
What to watch
Users should verify their current SAM version immediately. If running an alpha build below 0.1.0-alpha.3, the system is exposed. Monitor vendor communications for further details on the patch. Watch for any signs of unauthorized service invocation in logs.
What made it possible
This incident illustrates the risks of inconsistent security enforcement across different network entry points. When one pathway enforces strict token validation while a parallel path bypasses it, attackers exploit the weaker route. Teams usually audit all ingress methods to ensure uniform policy application. Check whether alternative interfaces exist that might skip standard authentication layers.
What to do and how to stay safe: Google
- Upgrade Google OSS Agent Mesh to version 0.1.0-alpha.3 or later immediately.
- Audit network logs for unexpected connections to backend services from unauthenticated peers.
- Restrict network access to the /libp2p-http ingress server to trusted sources only.
- Review Biscuit capability policies to ensure they are enforced across all service handlers.
Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk
General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-102503?
The CVSS score is 9.3, which is rated as critical by the NVD.
Which versions of Google Agent Mesh are affected?
Versions 0.1.0-alpha.1 through 0.1.0-alpha.2 are affected by this vulnerability.
Is there a fix available for this issue?
Yes, users should upgrade to version 0.1.0-alpha.3 or later.
