The MCP proxy and OIDC registration flow in Google OSS Agent Mesh suffer from missing authorization and an insecure default policy. The HandleStreamPassThrough function and the /info and /register endpoints allow a remote attacker to create a new mesh credential by simply providing any valid OIDC token. Once registered, the attacker inherits full read, write, and execution rights across all backend MCP nodes, effectively enabling arbitrary tool execution on every connected service.

Versions 0.1.0‑alpha.1 through 0.1.0‑alpha.8 of the Google OSS Agent Mesh (SAM) were affected. The fix appears in 0.1.0‑alpha.9, which introduces a fail‑closed policy, explicit binding requirements on enrollment, and ban checks.

The CVSS score of 9.3 indicates a critical vulnerability, and while an EPSS score is not provided, the public nature of the endpoints and lack of claim filtering suggest a high exploit likelihood. The vulnerability is not listed in the CISA KEV catalog but poses significant risk, especially in environments where OIDC tokens are broadly available. Remote attackers can exploit this flaw simply by sending HTTP requests to the exposed endpoints, making additional authentication or privileged access unnecessary.