CVE-2026-102503: CWE-306 Missing Authentication for Critical Function in Google SAM

The vulnerability arises from missing authentication (CWE-306) and missing authorization (CWE-862) in the /libp2p-http ingress server component of Google SAM. Specifically, while the MCP protocol stream handler enforces Biscuit token authentication and authorization, the parallel /libp2p-http ingress routes do not verify Biscuit tokens or mesh enrollment. This allows an unauthenticated remote libp2p peer to bypass policy enforcement and invoke arbitrary registered backend services, including command/stdio-backed MCP servers, A2A, and inference endpoints. The issue affects versions from 0.1.0-alpha.1 up to but not including 0.1.0-alpha.3.

An unauthenticated remote attacker can bypass critical capability policy enforcement and invoke arbitrary backend services, potentially leading to unauthorized command execution and access to sensitive services within the mesh environment. The CVSS 4.0 score of 9.3 reflects the critical severity with network attack vector, no required privileges or user interaction, and high impacts on confidentiality, integrity, and availability.

Users should upgrade to Google SAM version 0.1.0-alpha.3 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the vendor advisory specifying the fixed version.