External risk intelligence

Google OSS Agent Mesh Unauthenticated Mesh Self-Enrollment and Tool Invocation

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-103091

The vulnerability affects a control plane server and registration flow designed to handle OIDC token enrollment and mesh orchestration. As an identity-aware gateway and management service for backend nodes, this component is commonly deployed as an externally accessible or edge-facing endpoint to facilitate connectivity and service registration, making it a likely target for network-based interaction.

Information Disclosure

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in Google OSS Agent Mesh affects its proxy and registration components, potentially allowing an unauthorized remote attacker to gain full control over connected backend nodes. The issue stems from insufficient authorization checks and insecure default settings during the enrollment process, which could permit an attacker to self-enroll and execute arbitrary commands across the mesh. The main concern is confirming relevance and exposure.

Unauthorized access to mesh tools.
Critical control plane vulnerability discovered.
Confirm relevance and scope immediately.

Attack Path

How an attacker could exploit the issue

An attacker can gain unauthorized access to a Google OSS Agent Mesh by exploiting vulnerabilities in the MCP proxy and OIDC registration flow. This allows them to self-enroll into the mesh and execute arbitrary commands on backend nodes, ultimately obtaining full control over services.

No authentication or privileges needed.
Public OIDC information and token enrollment.
Full access and execution on backend services.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a remote attacker to self-enroll in the mesh and execute arbitrary commands on all connected nodes. It could also grant an attacker full read, write, and execution access to backend services by obtaining a mesh credential.

Mesh credentials and backend services.
Via OIDC registration and unsecured endpoints.
Unauthorized command execution and data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Google OSS Agent Mesh's MCP proxy and OIDC registration flow are affected by vulnerabilities that allow remote attackers to self-enroll and control backend nodes. Identifying where this technology is deployed, assessing its reachability and criticality, and then determining the accountable owner are the critical first steps before planning remediation.

Platform or application owners should lead.
Verify external access and reachability first.
Plan phased remediation by risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google OSS Agent Mesh (SAM)?

Google OSS Agent Mesh is an infrastructure component designed to manage connectivity and communication between different backend services. It acts as a mesh orchestration layer, utilizing an MCP proxy to handle data streams and a control plane to manage identity-based service enrollment and tool invocation.

What does CWE-862 and CWE-1188 mean for CVE-2026-103091?

These codes represent Missing Authorization and Insecure Default Initialization. In this CVE, it means the software fails to verify who is allowed to join the mesh and improperly defaults to a highly permissive state. Essentially, the system trusts any incoming connection request without checking credentials, allowing unauthorized entities to register themselves as valid participants.

How can an attacker trigger this vulnerability?

An attacker can trigger this by interacting with the mesh's registration flow. They do not need existing privileges; they simply use the public OIDC configuration to request enrollment. Importantly, merely having an OIDC token is enough to be auto-enrolled, as the system currently lacks checks to filter or ban unauthorized users.

Is my deployment at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a likely risk because the affected control plane and registration services are often deployed as edge-facing endpoints. If your instance is externally accessible to facilitate service registration or mesh connectivity, it is a primary candidate for remote network-based interaction by unauthorized actors.

What should I do if I use Google OSS Agent Mesh?

First, identify all instances of the software within your environment and assess their network reachability. Once you have located these assets, prioritize upgrading to version 0.1.0-alpha.9 or later. This update changes the system's behavior to a fail-closed default, meaning it will no longer automatically trust or enroll new connections without explicit authorization.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.