Critical Auth Bypass in Google SAM Agent Mesh Lets Peers Invoke Backends
Unauthenticated libp2p peers can bypass security checks in Google SAM versions 0.1.0-alpha.1 and 0.1.0-alpha.2 to invoke arbitrary backend services.
Key points
- CVE-2026-102503 is rated CVSS 9.3 Critical due to missing authentication and authorization in the libp2p-http ingress server.
- The flaw allows remote peers to bypass Biscuit capability policies and access MCP servers, A2A, and inference endpoints.
- Google released version 0.1.0-alpha.3 to fix the vulnerability, which affects earlier alpha releases of the OSS Agent Mesh.
Google has released a patch for a critical authentication bypass vulnerability in its open-source Agent Mesh (SAM) project. The flaw, tracked as CVE-2026-102503, allows unauthenticated remote peers to invoke arbitrary backend services without proper authorization checks.
At a glance
- CVE
- CVE-2026-102503
- Product
- Google SAM
- CVSS
- 9.3 Critical
- Weakness
- missing authentication
- Exploited
- No known exploitation
The vulnerability exists in the /libp2p-http ingress server component of SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.2. According to the National Vulnerability Database record, the issue stems from missing authentication for critical functions and missing authorization controls. This allows attackers to bypass Biscuit capability policy enforcement entirely.
Technical Details of the Flaw
The NVD record describes the weakness as a combination of CWE-306 and CWE-862. While the standard Model Context Protocol (MCP) stream handler enforces WithBiscuitAuth and Authorize checks, the parallel /libp2p-http ingress routes requests directly to backend service handlers. This routing occurs without verifying a Biscuit token or mesh enrollment status.
An unauthenticated remote libp2p peer can exploit this gap to invoke registered backend services. These services include command and stdio-backed MCP servers, Agent-to-Agent (A2A) interfaces, and inference endpoints. The flaw effectively neutralizes the security boundaries intended by the Biscuit policy framework.
Impact and Affected Versions
The vulnerability affects Google OSS Agent Mesh versions 0.1.0-alpha.1 and 0.1.0-alpha.2. Any deployment running these specific alpha builds is exposed to remote unauthorized access. The critical nature of the flaw is reflected in its CVSS score of 9.3.
This incident follows earlier reporting by Threat Times on October 18, 2026, when Google Research open-sourced the Harness2 framework for recursive agent optimization. That release focused on improving agent performance through external harness components, distinct from the security infrastructure of the SAM mesh.
What should you do?
Users running Google SAM should immediately upgrade to version 0.1.0-alpha.3 or later. This update resolves the authentication bypass in the libp2p-http ingress server. Administrators should verify that all nodes in their mesh are running the patched version.
What to do and how to stay safe: Google
- Audit your deployment to confirm you are not running SAM versions 0.1.0-alpha.1 or 0.1.0-alpha.2.
- Upgrade to version 0.1.0-alpha.3 or later once the vendor provides an update to restore proper authorization checks.
- Monitor network logs for unexpected connections to libp2p-http ingress ports from unauthenticated peers.
- Review Biscuit token logs to ensure that all backend service invocations are properly authenticated and authorized.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-102503?
The vulnerability has a CVSS score of 9.3, which is rated as Critical.
Which versions of Google SAM are affected?
Versions 0.1.0-alpha.1 through 0.1.0-alpha.2 are affected by this vulnerability.
Is there a fix available?
Yes, users should upgrade to version 0.1.0-alpha.3 or later to resolve the issue.
