What happened
Google published (2026-10-19) an advisory in which the /libp2p-http ingress server fails to enforce Biscuit capability policy, letting an unauthenticated remote libp2p peer invoke arbitrary registered backend services including stdio-backed MCP servers and inference endpoints. CVSS 9.3 (v4.0) CRITICAL; CISA SSVC automatable=yes, exploitation=poc.
Why it matters
In an agent mesh, the gateway is the chokepoint through which agents reach MCP tools and models. A bypass lets an unauthenticated peer treat command-backed MCP servers as reachable without authorization, which translates directly to code execution on backend nodes and access to model/inference endpoints.
Attack vector
The MCP stream handler enforces Biscuit auth, but the parallel /libp2p-http ingress (StartIngressServer in cmd/sam-node/node.go) routes requests directly to backend service handlers without verifying a Biscuit token or mesh enrollment (CWE-306 + CWE-862).
Affected systems
Google SAM (github.com/google/sam) 0.1.0-alpha.1 through 0.1.0-alpha.2
Mitigation
Upgrade to v0.1.0-alpha.3 or later.