---
id: "CVE-2026-103090"
kind: "vulnerability"
aliases: ["CVE-2026-103090"]
title: "Google SAM: unauthenticated enrollment endpoint leaks peer identity tokens"
severity: "high"
cvss: 8.8
epss: 0.00335
exploited: false
status: "resolved"
category: "package"
products: [{"name": "google/sam", "fixed": ["0.1.0-alpha.9"], "affected": ">= 0.1.0-alpha.1, < 0.1.0-alpha.9", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["agent-mesh", "kubernetes", "mcp", "package", "sam", "self-hosted"]
not_affected_if: ["control-plane-not-internet-exposed", "default-config", "managed-hosting", "oidc-enrolled-peers"]
published_at: "2026-10-21T23:17:24+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103090", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:46:25+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-103090", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Google SAM: unauthenticated enrollment endpoint leaks peer identity tokens

Google SAM (Sovereign/OSS Agent Mesh, github.com/google/sam) control plane: GET /enroll/status needs no credential and returns an approved bootstrap-enrolled peer's signed Biscuit token. The peer_id it needs is published by the unauthenticated GET /info. The token works as a bearer credential on /policies (read mesh roles and bindings, including member emails) and /routers/lease (overwrite advertised router addresses, so mesh-join disruption). Limits: only bootstrap-token-enrolled peers, mostly routers (the chart default router path is affected); OIDC-enrolled peers are not; the stolen token is valid for 24h from approval. Public exposure depends on the Gateway/HTTPRoute exposing the enrollment paths (chart gateway.enabled is false by default).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:google/sam affected >= 0.1.0-alpha.1, < 0.1.0-alpha.9 fixed 0.1.0-alpha.9

## How to check

Run the control plane and check the version: affected if it is github.com/google/sam < v0.1.0-alpha.9 (0.1.0-alpha.1 to alpha.8). Check whether the control plane is internet-reachable: curl https://<control-plane>/info lists router addresses (and the peer IDs), and curl 'https://<control-plane>/enroll/status?peer_id=<id>' returning ENROLLMENT_STATUS_APPROVED with a biscuit_token means you are exposed. Check whether routers were enrolled with bootstrap tokens (router.useOidcToken: false, the chart default).

## Fix

Upgrade to v0.1.0-alpha.9 or later. After upgrading, restart or re-enroll routers so their enrollment-time Biscuits are replaced, and review /policies and router lease addresses for tampering. If you cannot upgrade, do not route /enroll/status and /info to the public internet (restrict the Gateway HTTPRoute to trusted networks).

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103090
- 2026-10-23T23:46:25+00:00 analyst — Read maintainer advisory GHSA-hp3x-79wr-rx66 (google/agentmesh): affected < v0.1.0-alpha.9, fixed alpha.9. Advisory has a private PoC (not public, not attached); no exploitation reported; no X chatter. Scope narrower than summary: only bootstrap-token-enrolled peers (mainly routers), OIDC-enrolled not affected, token valid 24h from approval. Did not read release notes for alpha.9 directly; fix details (PoP, rate limit) come from MindPattern/vendor summaries.
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-103090

## Documents

- [advisory] GHSA-hp3x-79wr-rx66: Unauthenticated GET /enroll/status returns an approved peer's Biscuit https://github.com/google/agentmesh/security/advisories/GHSA-hp3x-79wr-rx66
- [describes] CVE-2026-103090 analysis (Ionix) https://www.ionix.io/threat-center/cve-2026-103090/

## From the sources

Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow an unauthenticated remote attacker to retrieve an approved bootstrap-enrolled peer's signed Biscuit identity token by supplying a peer_id obtainable from the unauthenticated GET /info endpoint. A related flaw in POST /enroll allowed any bootstrap-token holder to re-fetch another peer's credential. An attacker can replay the disclosed Biscuit token as a bearer credential on /policies to read mesh authorization policies and on /routers/lease to overwrite advertised router multiaddrs. Users should upgrade to version 0.1.0-alpha.9 or later, which requires cryptographic proof of possession of the enrollment private key on credential-releasing endpoints, enforces rate limiting, and validates router lease addresses.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_