CVE-2026-102503
Received Received - Intake

Authentication Bypass in Google OSS Agent Mesh

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Google Inc.

Description
Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services (including command/stdio-backed MCP servers, A2A, and inference endpoints). While the MCP protocol stream handler enforces WithBiscuitAuth and Authorize checks, the parallel /libp2p-http ingress routes requests directly to backend service handlers without verifying a Biscuit token or mesh enrollment. Users should upgrade to version 0.1.0-alpha.3 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-102503
EUVD
EUVD-2026-104049

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Google SAM 0.1.0-alpha.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-102503 is an authorization bypass vulnerability in Google's Sovereign Agent Mesh (SAM) project affecting versions before 0.1.0-alpha.3. The /libp2p-http ingress path does not enforce authorization checks, allowing any remote peer to invoke backend services without valid credentials or enrollment. This bypasses the intended security boundary enforced by biscuit policies on the MCP protocol path.

Detection Guidance

To detect this vulnerability, check if your SAM node is running a version prior to 0.1.0-alpha.3. Verify the ingress server configuration and inspect network traffic for unauthorized access attempts to /libp2p-http endpoints. Monitor logs for requests bypassing authentication.

Impact Analysis

An unauthenticated remote attacker could exploit this to invoke arbitrary backend services, including command/stdio-backed MCP servers, A2A, or inference endpoints. This could lead to remote code execution (RCE) or destructive actions on affected systems. The default configuration binds to 0.0.0.0 and uses public DHT discovery, making the vulnerability exploitable over the network.

Compliance Impact

The vulnerability allows unauthorized remote access to backend services, potentially exposing sensitive data processed by MCP servers, A2A, or inference endpoints. This could violate GDPR's data protection requirements (e.g., unauthorized access to personal data) and HIPAA's safeguards for protected health information (PHI) if such data is involved.

Mitigation Strategies

Upgrade to SAM version 0.1.0-alpha.3 or later immediately. Ensure biscuit token verification is enforced on the /libp2p-http ingress path. Review and restrict network access to SAM nodes, and audit backend service configurations for unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102503. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart