Google Agent Mesh Ingress Bypasses Auth in Alpha Builds

Google's open-source Agent Mesh (SAM) project contains a critical authentication bypass in its libp2p-http ingress server. This flaw allows unauthenticated remote peers to invoke arbitrary registered backend services. Security operations teams running alpha versions of this mesh infrastructure face exposure to unauthorized service invocation. The vulnerability stems from missing authorization checks on specific request routes.

Root cause

The issue arises from inconsistent security enforcement within the mesh's ingress layer. While the MCP protocol stream handler correctly enforces Biscuit authentication and authorization checks, the parallel /libp2p-http ingress routes requests directly to backend service handlers. These HTTP routes fail to verify Biscuit tokens or mesh enrollment status. Consequently, the system treats unauthenticated traffic as valid, bypassing critical policy enforcement mechanisms.

Attack path

An attacker connects as a remote libp2p peer to the affected ingress server. By sending requests through the /libp2p-http route, they circumvent the standard Biscuit capability policy checks. This allows them to invoke any registered backend service without presenting valid credentials. Targeted services can include command-backed MCP servers, A2A interfaces, and inference endpoints. The attacker gains unauthorized access to these backend functions.

Affected versions

• Google OSS Agent Mesh version 0.1.0-alpha.1
• Google OSS Agent Mesh version 0.1.0-alpha.2
• Any build prior to version 0.1.0-alpha.3

Mitigation

• Upgrade immediately to Google SAM version 0.1.0-alpha.3 or later.
• Isolate affected mesh nodes from untrusted libp2p networks.
• Audit backend service logs for unauthorized invocation attempts.
• Restrict ingress traffic to known, authenticated peers only.

Signals worth monitoring

Teams usually detect this activity by reviewing ingress server logs for requests lacking Biscuit tokens. Check whether backend services received calls from unexpected libp2p peer IDs. Look for spikes in API usage on inference endpoints or MCP servers that do not correlate with legitimate mesh traffic. Monitor for errors related to missing authorization headers on the HTTP ingress routes. Containment involves blocking suspicious peer IPs at the network level and verifying that all active nodes run patched software versions.

Background: Unauthorized access

Prioritise least privilege and multi-factor authentication over perimeter defences. Remove stale accounts, enforce strict identity verification and limit data exposure. These steps reduce the attack surface significantly and make lateral movement difficult for intruders.

Read the full guide: Stop Unauthorized Access: Practical Controls That Actually Work

What to do and how to stay safe: Google

• Verify all SAM nodes are running version 0.1.0-alpha.3 or newer.
• Inspect libp2p peer lists for unauthorized connections and disconnect them.
• Review backend service logs for unauthenticated request patterns.
• Implement network-level restrictions on ingress ports until patched.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVE covers this Agent Mesh authentication bypass?

CVE-2026-102503 covers the missing authentication and authorization flaws in Google SAM.

What versions of Google SAM are vulnerable?

Versions 0.1.0-alpha.1 through 0.1.0-alpha.2 are affected by this vulnerability.

Is there a patch available for this issue?

Yes, users should upgrade to version 0.1.0-alpha.3 or later to resolve the issue.