CVE-2026-103090

Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow an unauthenticated remote attacker to retrieve an approved bootstrap-enrolled peer's signed Biscuit identity token by supplying a peer_id obtainable from the unauthenticated GET /info endpoint. A related flaw in POST /enroll allowed any bootstrap-token holder to re-fetch another peer's credential. An attacker can replay the disclosed Biscuit token as a bearer credential on /policies to read mesh authorization policies and on /routers/lease to overwrite advertised router multiaddrs. Users should upgrade to version 0.1.0-alpha.9 or later, which requires cryptographic proof of possession of the enrollment private key on credential-releasing endpoints, enforces rate limiting, and validates router lease addresses.

• CWE-306
• CWE-522

• https://github.com/google/sam/releases/tag/v0.1.0-alpha.9
• https://github.com/google/sam/security/advisories/GHSA-hp3x-79wr-rx66

Published

Oct 21, 2026

Last Modified

Oct 22, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103083Authorization Bypass Through User-Controlled Key vulnerabili…5.4
• CVE-2026-103084Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-103085Improper Access Control vulnerability in WP User Manager WP …6.5
• CVE-2026-103086Missing Authorization vulnerability in Stiofan UsersWP users…6.5
• CVE-2026-103087Uncontrolled recursion in the Gosub browser engine (gosub-en…7.1
• CVE-2026-103088Handlebars.java before 4.5.5 allows directory traversal. In …7.5
• CVE-2026-103091Missing Authorization (CWE-862) and Initialization of a Reso…9.3
• CVE-2026-103096API key is hardcoded and retrievable from the application pa…7.5
• CVE-2026-103097An API key is hardcoded and retrievable from the application…7.5
• CVE-2026-103098Transmission of a sensitive key in the URL over an unencrypt…7.5
• CVE-2026-103099Pexip Infinity before 41.1 is affected by improper input val…7.5
• CVE-2026-1031IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2…6.1