← Back to the live CVE advisory feed

CVE-2026-102503: cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM)

Severity

9.3 (CRITICAL)

Vendor

GOOGLE

Affected versions

Through 0.1.0-alpha.2

Fixed version

0.1.0-alpha.3

Patch status

Patched

Published

2026-10-19T03:16:58.193

Why it matters

This matters because the issue affects identity or token handling. Successful exploitation could allow unauthorized authentication, client manipulation, or access to protected services.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services (including command/stdio-backed MCP servers, A2A, and inference endpoints). While the MCP protocol stream handler enforces WithBiscuitAuth and Authorize checks, the parallel /libp2p-http ingress routes requests directly to backend service handlers without verifying a Biscuit token or mesh enrollment. Users should upgrade to version 0.1.0-alpha.3 or later.

View the official NVD record for CVE-2026-102503

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.