Key points
- CVE-2026-102503 affects Google Agent Mesh versions 0.1.0-alpha.1 through 0.1.0-alpha.2.
- The vulnerability carries a CVSS score of 9.3, rated as critical severity.
- Attackers can bypass Biscuit policy enforcement to access arbitrary registered backend services.
A critical authentication bypass in Google’s open-source Agent Mesh allows unauthenticated remote peers to invoke backend services. The flaw exists in versions 0.1.0-alpha.1 through 0.1.0-alpha.2, exposing environments that rely on the default ingress server configuration.
The issue stems from missing authentication and authorization controls in the /libp2p-http ingress server. While the standard MCP protocol stream handler enforces Biscuit capability checks, the parallel ingress route sends requests directly to backend handlers. This path skips token verification and mesh enrollment checks entirely.
Technical Context
According to the National Vulnerability Database record, the flaw combines CWE-306 and CWE-862 weaknesses. The StartIngressServer function in cmd/sam-node/node.go fails to verify credentials for incoming libp2p peers. Consequently, any remote peer can bypass policy enforcement mechanisms designed to restrict service access.
This architectural gap allows attackers to reach arbitrary registered backend services. These services include command and stdio-backed Model Context Protocol servers, Agent-to-Agent endpoints, and inference interfaces. The exposure is significant because it grants direct service invocation capabilities without prior identity validation.
Affected Versions
Google Agent Mesh versions 0.1.0-alpha.1 and 0.1.0-alpha.2 are vulnerable to this authentication bypass. Any deployment using these specific alpha releases is at risk if the ingress server is accessible to untrusted libp2p peers. The vulnerability does not affect version 0.1.0-alpha.3 or later releases.
Next steps
Users running affected versions should upgrade to 0.1.0-alpha.3 or later immediately. This update patches the missing authorization checks in the ingress server. Until the upgrade is applied, teams should restrict network access to the ingress endpoints to trusted peers only.
Signals worth monitoring
Teams usually check ingress logs for requests lacking valid Biscuit tokens. Look for unusual traffic patterns from unknown libp2p peers targeting backend handlers. Verify that all incoming requests pass through the standard MCP stream handler. Check for unexpected command executions or inference calls. Isolate affected nodes if unauthorized access is detected. Review firewall rules to limit exposure of the /libp2p-http endpoint to necessary peers only.
What to do and how to stay safe: Google
- Verify your current Google Agent Mesh version and upgrade to 0.1.0-alpha.3 or later if running an affected release.
- Restrict network access to the /libp2p-http ingress server to only trusted libp2p peers until patched.
- Monitor ingress logs for requests that bypass standard Biscuit authentication checks.
- Audit registered backend services to ensure they are not exposed to unauthenticated remote peers.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-102503?
The CVSS score is 9.3, which is rated as critical severity.
Which versions of Google Agent Mesh are affected?
Versions 0.1.0-alpha.1 through 0.1.0-alpha.2 are affected by this vulnerability.
Is there a patch available for this issue?
Yes, users should upgrade to version 0.1.0-alpha.3 or later to resolve the issue.
