Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-102503 Details

Description

Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services (including command/stdio-backed MCP servers, A2A, and inference endpoints). While the MCP protocol stream handler enforces WithBiscuitAuth and Authorize checks, the parallel /libp2p-http ingress routes requests directly to backend service handlers without verifying a Biscuit token or mesh enrollment. Users should upgrade to version 0.1.0-alpha.3 or later.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/google/agentmesh/security/advisories/GHSA-r6hp-67wp-c7jx	CISA-ADP
https://github.com/google/sam/commit/433bc99d2a2c10071167bf22acc2c930a12e64e1	[email protected]
https://github.com/google/sam/releases/tag/v0.1.0-alpha.3	[email protected]
https://github.com/google/sam/security/advisories/GHSA-r6hp-67wp-c7jx	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-306	Missing Authentication for Critical Function	[email protected]
CWE-862	Missing Authorization	[email protected]

Affected Products

No affected product data is available for this CVE.

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 19, 2026	CVE Modified	CISA-ADP
Oct 19, 2026	New CVE Received	[email protected]