{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-103091",
    "name": "CVE-2026-103091",
    "vendor": "Google OSS Agent Mesh",
    "description": "CVE-2026-103091 (published 19 October 2026, CVSS 9.3): in Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 to alpha.8, GET /info disclosed the OIDC configuration, POST /register auto-enrolled any valid OIDC token holder without claim filtering or ban checks, and the default policy bound every authenticated identity to all services, so an outsider could self-enroll and invoke arbitrary tools on every connected MCP backend; 0.1.0-alpha.9 enforces a fail-closed default. GHSA-953h-535j-jg2v (19 October, CVSS 6.8): the MCP proxy in Envoy AI Gateway (agent-router) embeds the caller's JWT subject in the session ID to prevent hijacking but never compared it on resume, and the Helm chart shipped the literal seed default-insecure-seed for the key that encrypts those IDs, so a session ID could be forged and another user's backend MCP session resumed; fixed in 1.2.0-rc1. Also published this week: CVE-2026-114123, where the documented Azure one-click deployment of the D365 F&O MCP Server left API_KEY empty, which disables authentication, on a public App Service (fixed in 1.11.0); CVE-2026-57207, where NetBox MCP Server with TRANSPORT=http had no authentication at all (fixed in 1.2.1); CVE-2026-115750 and CVE-2026-115751, where mcp-from-openapi forwarded Authorization and Cookie headers on cross-origin redirects and its SSRF denylist could be bypassed (fixed in 2.9.0); and CVE-2026-115845, a validator gap in the run_script tool of the AWS MCP Server that AWS fixed service-side.",
    "website": "https://nvd.nist.gov/vuln/detail/CVE-2026-103091",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-10-19",
    "risk": {
      "score": 93,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-103091",
      "aliases": [
        "ti-155",
        "GHSA-953h-535j-jg2v"
      ],
      "title": "MCP Gateways and Hosted Servers: Google's Agent Mesh Let Any OIDC Token Holder Enroll and Call Every Backend Tool (CVE-2026-103091, CVSS 9.3), Envoy AI Gateway Resumed Other Users' MCP Sessions, and Three Servers Shipped Without Authentication or Leaked Tokens",
      "summary": "CVE-2026-103091 (published 19 October 2026, CVSS 9.3): in Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 to alpha.8, GET /info disclosed the OIDC configuration, POST /register auto-enrolled any valid OIDC token holder without claim filtering or ban checks, and the default policy bound every authenticated identity to all services, so an outsider could self-enroll and invoke arbitrary tools on every connected MCP backend; 0.1.0-alpha.9 enforces a fail-closed default. GHSA-953h-535j-jg2v (19 October, CVSS 6.8): the MCP proxy in Envoy AI Gateway (agent-router) embeds the caller's JWT subject in the session ID to prevent hijacking but never compared it on resume, and the Helm chart shipped the literal seed default-insecure-seed for the key that encrypts those IDs, so a session ID could be forged and another user's backend MCP session resumed; fixed in 1.2.0-rc1. Also published this week: CVE-2026-114123, where the documented Azure one-click deployment of the D365 F&O MCP Server left API_KEY empty, which disables authentication, on a public App Service (fixed in 1.11.0); CVE-2026-57207, where NetBox MCP Server with TRANSPORT=http had no authentication at all (fixed in 1.2.1); CVE-2026-115750 and CVE-2026-115751, where mcp-from-openapi forwarded Authorization and Cookie headers on cross-origin redirects and its SSRF denylist could be bypassed (fixed in 2.9.0); and CVE-2026-115845, a validator gap in the run_script tool of the AWS MCP Server that AWS fixed service-side.",
      "severity": "critical",
      "cvss": {
        "score": 9.3,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Authentication bypass",
        "Server-side request forgery"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "Google OSS Agent Mesh",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 to alpha.8; Envoy AI Gateway 0.4.0-rc1 to before 1.2.0-rc1; D365 F&O MCP Server before 1.11.0 (Azure one-click deployment); NetBox MCP Server before 1.2.1 with TRANSPORT=http; mcp-from-openapi 2.2.0 to before 2.9.0; AWS MCP Server (fixed service-side, no action needed).",
          "fixed": "0.1.0-alpha.9"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-10-19",
      "modifiedAt": "2026-10-19",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103091"
        },
        {
          "type": "advisory",
          "url": "https://github.com/advisories/GHSA-953h-535j-jg2v"
        }
      ],
      "mitigation": "Upgrade SAM to 0.1.0-alpha.9 or later and review enrolled identities and policy bindings. Upgrade Envoy AI Gateway to 1.2.0-rc1 or later and replace the default session-encryption seed with a random secret, since the shipped default makes session IDs forgeable. Upgrade D365 F&O MCP Server to 1.11.0, NetBox MCP Server to 1.2.1 and mcp-from-openapi to 2.9.0, and rotate any API key or bearer token that passed through an exposed instance. Never expose a remote MCP server without authentication or a network restriction, and keep an inventory of which remote MCP servers your users connect to.",
      "detectedByAnomity": true
    }
  }
}