The vulnerability arises from missing authentication (CWE-306) and missing authorization (CWE-862) on the /libp2p-http ingress route in Google OSS Agent Mesh (SAM). The endpoint processes libp2p requests without checking Biscuit tokens or mesh enrollment, allowing an unauthenticated peer to invoke any registered backend service, including MCP servers, A2A, and inference endpoints. This effectively bypasses the intended Biscuit capability policy enforcement and can lead to arbitrary code or command execution on the host.

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 are vulnerable. The fix is introduced in version 0.1.0-alpha.3 and later, which enforce proper authentication and authorization on the /libp2p-http ingress route.

The CVSS score of 9.3 denotes critical severity. EPSS data is missing, but the absence of authentication and the ability to target any backend make exploitation straightforward for an attacker who can establish a libp2p connection. The vulnerability is not listed in the CISA KEV catalog, but the potential for remote code execution warrants immediate remediation. Attackers can reach the ingress endpoint over the network, inject malicious requests, and trigger backend services without privileges, making the exploit highly feasible.