{"id":"CVE-2026-102503","kind":"vulnerability","aliases":["CVE-2026-102503"],"related":[],"title":"Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http…","description":"Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services (including command/stdio-backed MCP servers, A2A, and inference endpoints). While the MCP protocol stream handler enforces WithBiscuitAuth and Authorize checks, the parallel /libp2p-http ingress routes requests directly to backend service handlers without verifying a Biscuit token or mesh enrollment. Users should upgrade to version 0.1.0-alpha.3 or later.","summary":"Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 expose a /libp2p-http ingress that forwards requests to backend services without checking Biscuit tokens or mesh enrollment. An unauthenticated remote libp2p peer can invoke any registered backend, including command-backed MCP servers, A2A and inference endpoints.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["a2a","agent-mesh","ai-tooling","libp2p","mcp","self-hosted"],"not_affected_if":["version-0.1.0-alpha.3-or-later"],"how_to_check":"Check the installed SAM version and confirm it is 0.1.0-alpha.1 or 0.1.0-alpha.2.","fix":"Upgrade to version 0.1.0-alpha.3 or later.","status":"open","published_at":"2026-10-19T03:16:58+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-23T22:08:53+00:00","updated_at":"2026-10-23T22:28:56+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T22:08:53Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to version 0.1.0-alpha.3 or later.\nunknown whether a configuration change alone mitigates it.","reach":"internet","impact":"high","summary":"Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 expose a /libp2p-http ingress that forwards requests to backend services without checking Biscuit tokens or mesh enrollment. An unauthenticated remote libp2p peer can invoke any registered backend, including command-backed MCP servers, A2A and inference endpoints.","category":"ai-tooling","who_cares":["agent-mesh","mcp","a2a","libp2p","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote peer runs command-backed MCP servers and backend services without authorization","analyst_note":"Confirm from the project's release notes or advisory whether /libp2p-http ingress is on by default and whether any config-only mitigation exists before alpha.3.","how_to_check":"Check the installed SAM version and confirm it is 0.1.0-alpha.1 or 0.1.0-alpha.2.\nunknown whether the /libp2p-http ingress is enabled by default in these versions.","needs_analyst":true,"not_affected_if":["version-0.1.0-alpha.3-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000803,"input_tokens":2961,"output_tokens":1013,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-102503':18A,21A '-2026':17A,20A '-306':7A,88C '-862':12A,93C '/libp2p-http':15A,47B,96C,153C '0.1.0':40B,43B,109C,112C,175C 'a2a':22B,78B,136C 'agent':24B,36B,105C 'agent-mesh':23B 'ai':27B 'ai-tool':26B 'allow':114C 'alpha.1':41B,110C 'alpha.2':44B,113C 'alpha.3':176C 'arbitrari':128C 'authent':2A,83C 'author':10A,91C,149C 'back':75B 'backend':53B,71B,130C,159C 'biscuit':57B,122C,165C 'bypass':121C 'capabl':123C 'check':56B,150C 'cmd/sam-node/node.go':101C 'command':74B 'command-back':73B 'command/stdio-backed':133C 'critic':4A,85C 'cve':16A,19A 'cwe':6A,11A,87C,92C 'direct':157C 'endpoint':81B,139C 'enforc':125C,146C 'enrol':61B,169C 'expos':45B 'forward':50B 'function':5A,86C 'googl':34B,103C 'handler':145C,161C 'host':33B 'includ':72B,132C 'infer':80B,138C 'ingress':48B,97C,154C 'invok':68B,127C 'later':178C 'libp2p':29B,65B,118C 'mcp':30B,76B,134C,142C 'mesh':25B,37B,60B,106C,168C 'miss':1A,9A,82C,90C 'oss':35B,104C 'parallel':152C 'peer':66B,119C 'polici':124C 'protocol':143C 'regist':70B,129C 'remot':64B,117C 'request':51B,156C 'rout':155C 'sam':38B,107C 'self':32B 'self-host':31B 'server':77B,98C,135C 'servic':54B,131C,160C 'startingressserv':99C 'stream':144C 'token':58B,166C 'tool':28B 'unauthent':63B,116C 'upgrad':172C 'user':170C 'verifi':163C 'version':39B,108C,174C 'withbiscuitauth':147C 'without':55B,162C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T03:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@google.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102503","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102503","severity":null,"published_at":"2026-10-19T03:16:58+00:00","modified_at":"2026-10-19T21:13:39+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}