Threats Tagged 'cve-2026-103091'
View all threats tagged with 'cve-2026-103091'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-103091'
Click on any threat for detailed analysis and mitigation recommendations
0 CVE-2026-103091 is a critical vulnerability in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8. It involves missing authorization and insecure default initialization in the MCP proxy and OIDC registration flow, allowing remote attackers to self-enroll and gain full read, write, and execution access on backend services. The vulnerability arises because the GET /info endpoint publicly exposes OIDC configuration, and the POST /register endpoint auto-enrolls any valid OIDC token holder without claim filtering or ban checks. The default policy binds authenticated users to wildcard services and targets, enabling broad unauthorized access. Upgrading to version 0.1.0-alpha.9 or later mitigates this issue by enforcing a fail-closed default policy and explicit enrollment requirements. Join the discussion | CVE Database V5 | 10/19/2026, 02:24:35 UTC Added: 10/19/2026, 02:48:52 UTC |
Showing 1 to 1 of 1 result