Threats tagged 'ghsa-xhg2-hv24-f4rp'

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 contain vulnerabilities involving missing authentication for critical functions and insufficiently protected credentials. These flaws allow unauthenticated remote attackers to retrieve signed Biscuit identity tokens of enrolled peers by exploiting unauthenticated endpoints. Attackers can replay these tokens to access mesh authorization policies and overwrite router addresses. Version 0.1.0-alpha.9 and later include fixes requiring cryptographic proof of enrollment private keys, rate limiting, and validation of router lease addresses.