Google OSS Agent Mesh (SAM) vulnerabilities

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 contain Missing Authorization (CWE-862) and Insecure Default Initialization (CWE-1188) in the MCP proxy and OIDC registration flow. Public disclosure of OIDC configuration via GET /info and auto-enrollment of any valid OIDC token holder via POST /register without claim filtering or ban checks allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes.

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 contain Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server. An unauthenticated remote libp2p peer can bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services, including command/stdio-backed MCP servers, A2A, and inference endpoints.

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 lack authentication in the enrollment status handler (GET /enroll/status). An unauthenticated remote attacker can retrieve an approved peer's signed Biscuit identity token by supplying a peer_id from the unauthenticated GET /info endpoint, then replay it as a bearer credential to read authorization policies and overwrite router multiaddrs.