CVE-2026-102503: Google Agent Mesh let any peer call MCP backends through an unchecked ingress

What it is

A SAM node exposes its backend services over two libp2p paths. The MCP protocol path checks the caller's Biscuit token and the node's allowed_tools / allowed_targets policy; the parallel /libp2p-http ingress sent requests straight to the same backend handlers with no token or enrollment check.

For stdio/command-backed MCP servers, the ingress wrote attacker-supplied JSON-RPC directly to the backend process, so an unenrolled peer could run whatever tools that server exposes. For URL-backed services it acted as an unauthenticated proxy to internal targets.

The advisory notes the defaults bind libp2p on 0.0.0.0 and use DHT discovery on the public testnet, so nodes are reachable from the network. The local --api-token only protects the loopback API, not this ingress.

How to check

1. Affected: github.com/google/sam (now github.com/google/agentmesh) 0.1.0-alpha.1 through 0.1.0-alpha.2.
2. Check whether any sam-node you run registers command/stdio MCP services or URL services that point at internal systems.

How to fix

1. Upgrade to 0.1.0-alpha.3 or later.
2. Until then, don't expose sam-node's libp2p ports to untrusted networks and don't register powerful command-backed MCP servers on it.

Sources

• Google Agent Mesh security advisory GHSA-r6hp-67wp-c7jx ↗
• Fix commit 433bc99 ↗
• NVD: CVE-2026-102503 ↗