MCP Gateways and Hosted Servers: Google's Agent Mesh Let Any OIDC Token Holder Enroll and Call Every Backend Tool (CVE-2026-103091, CVSS 9.3), Envoy AI Gateway Resumed Other Users' MCP Sessions, and Three Servers Shipped Without Authentication or Leaked Tokens

CVE-2026-103091 (published 19 October 2026, CVSS 9.3): in Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 to alpha.8, GET /info disclosed the OIDC configuration, POST /register auto-enrolled any valid OIDC token holder without claim filtering or ban checks, and the default policy bound every authenticated identity to all services, so an outsider could self-enroll and invoke arbitrary tools on every connected MCP backend; 0.1.0-alpha.9 enforces a fail-closed default. GHSA-953h-535j-jg2v (19 October, CVSS 6.8): the MCP proxy in Envoy AI Gateway (agent-router) embeds the caller's JWT subject in the session ID to prevent hijacking but never compared it on resume, and the Helm chart shipped the literal seed default-insecure-seed for the key that encrypts those IDs, so a session ID could be forged and another user's backend MCP session resumed; fixed in 1.2.0-rc1. Also published this week: CVE-2026-114123, where the documented Azure one-click deployment of the D365 F&O MCP Server left API_KEY empty, which disables authentication, on a public App Service (fixed in 1.11.0); CVE-2026-57207, where NetBox MCP Server with TRANSPORT=http had no authentication at all (fixed in 1.2.1); CVE-2026-115750 and CVE-2026-115751, where mcp-from-openapi forwarded Authorization and Cookie headers on cross-origin redirects and its SSRF denylist could be bypassed (fixed in 2.9.0); and CVE-2026-115845, a validator gap in the run_script tool of the AWS MCP Server that AWS fixed service-side.

You are affected if you run Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 to alpha.8; Envoy AI Gateway 0.4.0-rc1 to before 1.2.0-rc1; D365 F&O MCP Server before 1.11.0 (Azure one-click deployment); NetBox MCP Server before 1.2.1 with TRANSPORT=http; mcp-from-openapi 2.2.0 to before 2.9.0; AWS MCP Server (fixed service-side, no action needed).. Versions 0.1.0-alpha.9 and later include the fix.

Upgrade SAM to 0.1.0-alpha.9 or later and review enrolled identities and policy bindings. Upgrade Envoy AI Gateway to 1.2.0-rc1 or later and replace the default session-encryption seed with a random secret, since the shipped default makes session IDs forgeable. Upgrade D365 F&O MCP Server to 1.11.0, NetBox MCP Server to 1.2.1 and mcp-from-openapi to 2.9.0, and rotate any API key or bearer token that passed through an exposed instance. Never expose a remote MCP server without authentication or a network restriction, and keep an inventory of which remote MCP servers your users connect to.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Google OSS Agent Mesh and which version, then enforce a policy on it.