What happened
Google published (2026-10-19) that the MCP proxy and OIDC registration flow in SAM let a remote attacker self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes. CVSS 9.3 (v4.0) CRITICAL; CISA SSVC exploitation=poc.
Why it matters
This is a credentialless path to control every MCP tool and agent backend in the mesh. An attacker who can hit the registration endpoint obtains a mesh credential with wildcard service/target binding, effectively owning the agent fleet and any MCP servers (including command-backed ones) behind it.
Attack vector
Missing authorization in the MCP proxy (HandleStreamPassThrough in mcp_service.go) plus an insecure default in the OIDC registration flow (GET /info and POST /register). GET /info publicly discloses OIDC config, POST /register auto-enrolls any valid token holder without claim filtering or ban checks, and the default policy binds sam:system:authenticated to wildcard services and targets (CWE-862 + CWE-1188).
Affected systems
Google SAM (github.com/google/sam) 0.1.0-alpha.1 through 0.1.0-alpha.8
Mitigation
Upgrade to v0.1.0-alpha.9 or later (fail-closed default policy, explicit policy binding, ban checks).