Read the docs
TI-2026-76227 Aliases CVE-2026-102503GHSA-vc9x-qg3j-cxg6

Missing authentication in Google OSS Agent Mesh (SAM) ingress

Priority HIGH 81CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Google OSS Agent Mesh (SAM) from 0.1.0-alpha.1 before 0.1.0-alpha.3 has missing authentication in its /libp2p-http ingress server (CWE-306). The ingress routes requests directly to backend service handlers without checking a Biscuit token or mesh enrollment, so the capability policy checks are bypassed. An unauthenticated remote libp2p peer can invoke any registered backend service, including command-backed MCP servers, A2A and inference endpoints.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services (including command/stdio-backed MCP servers, A2A, and inference endpoints). While the MCP protocol stream handler enforces WithBiscuitAuth and Authorize checks, the parallel /libp2p-http ingress routes requests directly to backend service handlers without verifying a Biscuit token or mesh enrollment. Users should upgrade to version 0.1.0-alpha.3 or later.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00429 37th percentileScored 2026-11-07
Fix Fixed SAM (Google): 0.1.0-alpha.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleSAM0.1.0-alpha.1 to before 0.1.0-alpha.30.1.0-alpha.3Patch availableCNA
  • SAM VendorGoogle Affected 0.1.0-alpha.1 to before 0.1.0-alpha.3 Fixed in 0.1.0-alpha.3 Patch available CNA

Remediation

Upgrade Google SAM to version 0.1.0-alpha.3 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA SAM (Google) Fixed in 0.1.0-alpha.3

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-102503
  2. 2026-10-19 Alias added: GHSA-vc9x-qg3j-cxg6
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-20 Priority changed: MEDIUM → HIGH

References

Patch 1

Advisory 1

Other 1

  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04898 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04600 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04346 Use after free in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2023-05824 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
See all 17247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences