CVE-2026-103091 | Google Agent Mesh up to 0.1.0-alpha.8 MCP Proxy mcp_service.go HandleStreamPassThrough authorization

October 19, 2026 Yanac

A vulnerability described as very critical has been identified in Google Agent Mesh up to 0.1.0-alpha.8. This vulnerability affects the function HandleStreamPassThrough of the file mcp_service.go of the component MCP Proxy. The manipulation results in missing authorization.

This vulnerability was named CVE-2026-103091. The attack may be performed from remote. There is no available exploit.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More