Google Sam vulnerabilities
3 known vulnerabilities affecting google/sam.
Total CVEs
3
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL2HIGH1
Vulnerabilities
Page 1 of 1
CVE-2026-102503P2CRITICALCVSS 9.3≥ 0.1.0-alpha.1, < 0.1.0-alpha.32026-10-19
CVE-2026-102503 [CRITICAL] CWE-306 CVE-2026-102503: Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /l
Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass Biscuit capability policy enforcement and invo
nvd
CVE-2026-103091P2CRITICALCVSS 9.3≥ 0.1.0-alpha.1, < 0.1.0-alpha.92026-10-19
CVE-2026-103091 [CRITICAL] CWE-200 CVE-2026-103091: Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188)
Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow a remote a
nvd
CVE-2026-103090P2HIGHCVSS 8.8≥ 0.1.0-alpha.1, < 0.1.0-alpha.92026-10-21
CVE-2026-103090 [HIGH] CWE-306 CVE-2026-103090: Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE
Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow an unauthenticated remote attacker to
nvd