Skip to content
AgentProv

2026-10-19 · 2026-Q4

Google OSS Agent Mesh and Envoy AI Gateway: Any OIDC Token Holder Could Self-Enroll and Call Every MCP Tool (CVE-2026-103091)

Primary layerL6 Identity / Run

Which agent, run, or tenant is this?

The question layer 6 asks, and failed here.
Fixable
Vendor patch
Vendor response
Patched
In the wild
No
Actor
Attacker

Target

Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 through alpha.8 and Envoy AI Gateway 0.4.0-rc1 before 1.2.0-rc1

Impact

In SAM (CVSS 9.3), `GET /info` disclosed the OIDC configuration, `POST /register` enrolled any valid OIDC token holder without claim filtering, and the default policy bound all authenticated identities to wildcard services, giving full read, write, and execute access to tools on every connected MCP backend. A second SAM flaw, CVE-2026-102503 (CVSS 9.3), skipped authorization on the libp2p HTTP ingress. In Envoy AI Gateway (CVSS 6.8), MCP session resume did not check the caller's subject, and the Helm chart's default seed let attackers forge session IDs

Root cause

Fail-open default policies and insecure shipped defaults in the layer meant to authorize agent-to-tool traffic

CVEs

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: Google OSS Agent Mesh and Envoy AI Gateway: Any OIDC Token Holder Could Self-Enroll and Call Every MCP Tool (CVE-2026-103091) (2026-10-19). https://agentprov.com/incidents/2026-10-19-google-oss-agent-mesh-and-envoy-ai-gateway-any-oidc-token-holder-could-self

Related