CVE-2026-103090
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 lack authentication in the enrollment status handler (GET /enroll/status). An unauthenticated remote attacker can retrieve an approved peer's signed Biscuit identity token by supplying a peer_id from the unauthenticated GET /info endpoint, then replay it as a bearer credential to read authorization policies and overwrite router multiaddrs.
Risk Assessment
An attacker can impersonate an enrolled peer, read mesh authorization policies, and redirect traffic by overwriting router multiaddrs, compromising confidentiality and integrity of the mesh network.
Recommendation
Upgrade SAM to version 0.1.0-alpha.9 or later, which requires cryptographic proof of possession of the enrollment private key, enforces rate limiting, and validates router lease addresses.
Other vulnerabilities in Google OSS Agent Mesh (SAM)
See all- CVE-2026-103091Critical
Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 contain Missing Authorization (CWE-862) and Insecure Default Initialization (CWE-1188) in the MCP proxy and OIDC registration flow. Public disclosure of OIDC configuration via GET /info and auto-enrollment of any valid OIDC token holder via POST /register without claim filtering or ban checks allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes.
- CVE-2026-102503Critical
Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 contain Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server. An unauthenticated remote libp2p peer can bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services, including command/stdio-backed MCP servers, A2A, and inference endpoints.
Original NVD description (English source)
Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow an unauthenticated remote attacker to retrieve an approved bootstrap-enrolled peer's signed Biscuit identity token by supplying a peer_id obtainable from the unauthenticated GET /info endpoint. A related flaw in POST /enroll allowed any bootstrap-token holder to re-fetch another peer's credential. An attacker can replay the disclosed Biscuit token as a bearer credential on /policies to read mesh authorization policies and on /routers/lease to overwrite advertised router multiaddrs. Users should upgrade to version 0.1.0-alpha.9 or later, which requires cryptographic proof of possession of the enrollment private key on credential-releasing endpoints, enforces rate limiting, and validates router lease addresses.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS