CVE-2026-103090: CWE-306 Missing Authentication for Critical Function in Google SAM

This vulnerability (CWE-306 and CWE-522) affects the control plane enrollment status handler in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8. An unauthenticated attacker can retrieve a peer's signed Biscuit identity token by exploiting missing authentication on the GET /enroll/status endpoint, using a peer_id obtained from the unauthenticated GET /info endpoint. Additionally, a related flaw in the POST /enroll endpoint allowed bootstrap-token holders to re-fetch other peers' credentials. The stolen Biscuit tokens can be replayed as bearer credentials to access sensitive mesh authorization policies via /policies and to overwrite router multiaddrs via /routers/lease. Version 0.1.0-alpha.9 and later address these issues by requiring cryptographic proof of possession of the enrollment private key on credential-releasing endpoints, implementing rate limiting, and validating router lease addresses.

An unauthenticated remote attacker can retrieve signed identity tokens of enrolled peers, enabling unauthorized access to mesh authorization policies and the ability to overwrite router multiaddrs. This compromises the integrity and confidentiality of the mesh network's control plane, potentially allowing unauthorized policy reading and network topology manipulation.

Users should upgrade to Google OSS Agent Mesh (SAM) version 0.1.0-alpha.9 or later. This version enforces cryptographic proof of possession of enrollment private keys on credential-releasing endpoints, applies rate limiting, and validates router lease addresses, effectively mitigating the vulnerability.