External risk intelligence

Google OSS Agent Mesh Ingress Server Authorization Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-102503

The vulnerability exists in an ingress server component responsible for routing network traffic to backend services. As an ingress and edge-facing gateway component designed to handle libp2p-http requests, it is commonly deployed as an internet-facing or network-edge service to facilitate remote communication with backend endpoints.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical security flaw in Google OSS Agent Mesh (SAM) that could allow unauthorized access to backend services. The vulnerability lies in how the system handles requests over the libp2p-http ingress server, potentially bypassing security checks and enabling the invocation of arbitrary services. The primary concern is confirming if our environment utilizes the affected technology and assessing any potential exposure.

Unprotected access to services.
Bypasses security policy enforcement.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach a vulnerable component by connecting to the `/libp2p-http` ingress server over the network. This server, which handles incoming HTTP requests, is exposed and does not verify if the incoming request is authenticated or authorized. As a result, an unauthenticated attacker can bypass security checks and directly invoke sensitive backend services.

Unauthenticated remote peer access required.
Invokes backend services without verification.
Leads to unauthorized access to services.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to bypass security checks and invoke arbitrary backend services. This could affect system data and service behavior when supported by the advisory.

Arbitrary backend service invocation.
Unauthenticated remote peer bypass.
Unauthorized command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Google OSS Agent Mesh (SAM) ingress server's missing authentication and authorization controls require immediate attention from platform and security teams responsible for network-facing services. The first step is to identify all SAM deployments, confirm their exposure and criticality, and then engage the accountable owners to plan remediation.

Platform and security teams own this.
Verify ingress reachability and criticality.
Upgrade to secure version immediately.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google OSS Agent Mesh?

Google OSS Agent Mesh (SAM) is a framework designed to manage and route communication between distributed software agents. It uses the libp2p protocol to facilitate networking between services, acting as a middleware layer that connects backend systems—such as AI inference endpoints and command-processing servers—so they can interact seamlessly across a network.

What does CVE-2026-102503 mean for security?

This vulnerability is classified as Missing Authentication (CWE-306) and Missing Authorization (CWE-862). In simple terms, the software fails to verify who a user is or what they are allowed to do before letting them access sensitive functions. Because of this flaw, the system blindly trusts requests sent to its ingress server, allowing unauthorized users to interact with backend services as if they were legitimate components.

How is this vulnerability triggered?

An attacker triggers this by connecting to the /libp2p-http ingress server as a remote peer. The bug exists because this specific path bypasses the standard security checks that other parts of the system use. It is important to note that requests sent through correctly secured paths that enforce token verification are not affected; the issue is isolated to the flawed route in the ingress server.

Do I need to worry if my service is internal?

Yes. Halo Surface Signal identifies this component as an ingress and edge-facing gateway, meaning it is often deployed specifically to bridge internal services with external networks. Even if you consider a service internal, any node reachable via the libp2p network could potentially be used to exploit this flaw, making it vital to verify how your SAM nodes are exposed to the network.

When should I upgrade to remediate this?

You should prioritize upgrading to version 0.1.0-alpha.3 or later immediately. The first step is to inventory your environment to locate all active SAM deployments. Once identified, confirm whether those instances are using the vulnerable ingress server path and coordinate with your technical teams to apply the patched version, which restores necessary authentication and authorization controls.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.