Google SAM CVE-2026-102503

Exploitation requires that the target node run an affected SAM version (0.1.0-alpha.1 or alpha.2) with the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) started and at least one backend service (MCP, A2A, or inference endpoint) registered, and that the attacker have libp2p network reachability to that ingress endpoint. No Biscuit token, mesh enrollment, authentication, or user interaction is needed - the ingress path omits the WithBiscuitAuth/Authorize checks entirely, so the bypass works against the default/affected configuration rather than a special opt-in setting. The practical limiting factors are therefore network reachability to the libp2p peer and the small installed base of this alpha software, not any authentication or configuration barrier.

All exploitability signals point one direction: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality, integrity, and availability impact on the vulnerable system (VC:H/VI:H/VA:H), scoring 9.3. The root cause is concrete and confirmed by the vendor advisory and patch commit: the /libp2p-http ingress path (StartIngressServer) routes directly to backend handlers without the WithBiscuitAuth/Authorize checks the parallel MCP stream handler enforces, so capability-policy bypass is structural rather than configuration-dependent. However, the signals that would elevate this to an active-priority patch are absent: no EPSS score was provided, there is no CISA KEV listing, and no public exploit code is referenced - so exploitation is possible and low-effort in theory but not demonstrated in the wild. The dominant mitigating factor is deployment scale, not technical difficulty: SAM is a pre-release alpha project (0.1.0-alpha.1/alpha.2), so real-world exposure is minimal despite the near-maximal score. Net: technically a genuine critical-severity auth bypass worth prompt patching for anyone running it, but the low-prevalence alpha footprint means it is not a mass-exploitation emergency.

An attacker who can reach the target's libp2p-http ingress endpoint connects as an unenrolled, unauthenticated remote peer and sends requests directly to the ingress server, which forwards them to registered backend handlers without checking for a Biscuit token or mesh enrollment. Because command/stdio-backed MCP servers, A2A, and inference endpoints are reachable this way, the attacker can invoke backend services they were never authorized for - potentially driving command/stdio MCP backends. No public exploit code is referenced, but the attack requires no authentication and low complexity.