CVE-2026-103091 Google CVE debrief

Who should care

Defenders and administrators of Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 should assess their exposure and upgrade to version 0.1.0-alpha.9 or later to fix the issue.

Why it matters

CVE-2026-103091 is a critical vulnerability in Google OSS Agent Mesh (SAM) that allows remote attackers to self-enroll and invoke arbitrary tools. Defenders and administrators should assess their exposure and upgrade to version 0.1.0-alpha.9 or later to fix the issue. The vulnerability requires verification of affected versions and remediation priority.

• Remote attackers can self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes.
• The default policy binds sam:system:authenticated to wildcard services and targets, allowing full read, write, and execution access on backend services.
• The vulnerability requires verification of affected versions and remediation priority.
• The corpus does not establish specific exploitation or impact, requiring further investigation.

Technical summary

The vulnerability is caused by missing authorization (CWE-862) and initialization of a resource with an insecure default (CWE-1188) in the MCP proxy and OIDC registration flow. This allows a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes. The issue arises from GET /info publicly disclosing OIDC configuration and POST /register auto-enrolling any valid OIDC token holder without claim filtering or ban checks. The default policy binds sam:system:authenticated to wildcard services and targets, allowing full read, write, and execution access on backend services. Users should upgrade to version 0.1.0-alpha.9 or later, which enforces a fail-closed default

Defensive priority

High

Recommended defensive actions

• Upgrade to version 0.1.0-alpha.9 or later
• Review and update the OIDC configuration and policy bindings
• Monitor for suspicious activity and enforce a fail-closed default policy
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not provide information on known exploitation or specific attack vectors.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.