Live › vulnerability › CVE-2026-103090
Go to dashboardGoogle SAM (Sovereign/OSS Agent Mesh, github.com/google/sam) control plane: GET /enroll/status needs no credential and returns an approved bootstrap-enrolled peer's signed Biscuit token. The peer_id it needs is published by the unauthenticated GET /info. The token works as a bearer credential on /policies (read mesh roles and bindings, including member emails) and /routers/lease (overwrite advertised router addresses, so mesh-join disruption). Limits: only bootstrap-token-enrolled peers, mostly routers (the chart default router path is affected); OIDC-enrolled peers are not; the stolen token is valid for 24h from approval. Public exposure depends on the Gateway/HTTPRoute exposing the enrollment paths (chart gateway.enabled is false by default).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| google/sam | go | >= 0.1.0-alpha.1, < 0.1.0-alpha.9 | 0.1.0-alpha.9 |
v0.1.0-alpha.9 (0.1.0-alpha.1 to alpha.8)https://<control-plane>/enroll/status?peer_id=<id> returning ENROLLMENT_STATUS_APPROVED with a biscuit_token means you are exposedv0.1.0-alpha.9 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow an unauthenticated remote attacker to retrieve an approved bootstrap-enrolled peer's signed Biscuit identity token by supplying a peer_id obtainable from the unauthenticated GET /info endpoint. A related flaw in POST /enroll allowed any bootstrap-token holder to re-fetch another peer's credential. An attacker can replay the disclosed Biscuit token as a bearer credential on /policies to read mesh authorization policies and on /routers/lease to overwrite advertised router multiaddrs. Users should upgrade to version 0.1.0-alpha.9 or later, which requires cryptographic proof of possession of the enrollment private key on credential-releasing endpoints, enforces rate limiting, and validates router lease addresses.
This page as .md · .json · in your agent: get_signal("CVE-2026-103090")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.