EUVD-2026-107668
GHSA-xhg2-hv24-f4rp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach control plane over network
-
DeliveryQuery unauthenticated GET /info for peer_id
-
ExploitFetch victim Biscuit token via GET /enroll/status
-
ExecutionReplay token as bearer on /policies and /routers/lease
-
ImpactRead mesh policy and overwrite router multiaddrs
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special configuration is required - the vulnerable GET /info and GET /enroll/status endpoints of the SAM control plane are exploitable by an unauthenticated remote attacker against default deployments of versions 0.1.0-alpha.1 through 0.1.0-alpha.8 (AV:N/AC:L/PR:N/UI:N). The related POST /enroll variant requires only possession of any bootstrap token. Exploitation is LIMITED by three factors: (1) the attacker must have network reachability to the control plane's enrollment/info endpoints; (2) at least one approved, bootstrap-enrolled peer must exist whose peer_id is discoverable via /info; and (3) only the affected alpha versions are vulnerable - upgrading to 0.1.0-alpha.9, which enforces cryptographic proof-of-possession of the enrollment private key on credential-releasing endpoints, closes the flaw. |
| Impact | The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L, score 8.8) describes a genuinely severe technical flaw: a fully unauthenticated, network-reachable, low-complexity attack chain requiring no user interaction that discloses signed Biscuit identity tokens and lets them be replayed for policy disclosure and router-lease tampering. However, several key real-world signals are MISSING from the input: no EPSS probability score was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced - so exploitation is best classified as 'no public exploit identified at time of analysis.' The SSVC-style picture is therefore split: technical impact is total (credential disclosure fully compromises the mesh identity model) and the flaw is plausibly automatable given the deterministic /info → peer_id → token sequence, but there is no evidence of active or widespread exploitation. The dominant mitigating factor is deployment footprint rather than exploitability: the affected product is early-alpha experimental software (0.1.0-alpha.1 through 0.1.0-alpha.8), so despite the high CVSS this is a high-severity-but-low-current-real-risk issue for most organizations. Teams actually running SAM in any exposed capacity should treat it as a priority and patch immediately, since the raw exploitability is high and a fix exists. |
| Exploit ScenarioDerived | An attacker with network access to a SAM control plane queries the unauthenticated GET /info endpoint to harvest a valid peer_id, then calls GET /enroll/status with that peer_id to retrieve the target peer's signed Biscuit identity token. The attacker replays the stolen token as a bearer credential against /policies to read mesh authorization policy and against /routers/lease to overwrite advertised router multiaddrs, enabling traffic redirection. No authentication, privileges, or user interaction are required (AV:N/AC:L/PR:N/UI:N); no public PoC is referenced, but the steps are deterministic and easily scripted. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated remote attackers can retrieve a signed Biscuit identity token belonging to any approved, bootstrap-enrolled peer from the Google OSS Agent Mesh (SAM) control plane in versions 0.1.0-alpha.1 through 0.1.0-alpha.8, then replay it as a bearer credential to read mesh authorization policies via /policies and to overwrite advertised router multiaddrs via /routers/lease. The chain requires only the peer_id that the unauthenticated GET /info endpoint discloses, so no credentials or user interaction are needed; a related POST /enroll flaw let any bootstrap-token holder re-fetch another peer's credential. Vendor-released patch: 0.1.0-alpha.9, which enforces cryptographic proof of possession of the enrollment private key on credential-releasing endpoints, adds rate limiting, and validates router lease addresses; no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Vendor-released patch: 0.1.0-alpha.9 - upgrade every SAM control plane (and its enrolled peers) from 0.1.0-alpha.1 through 0.1.0-alpha.8 to 0.1.0-alpha.9 or later, per https://github.com/google/sam/security/advisories/GHSA-hp3x-79wr-rx66 and https://github.com/google/sam/releases/tag/v0.1.0-alpha.9, which adds enrollment-private-key proof of possession on credential-releasing endpoints, rate limiting, and router lease address validation. Because tokens disclosed before the upgrade remain valid bearer credentials, treat every Biscuit token issued by an affected control plane as compromised: rotate or revoke issued tokens and bootstrap tokens and force peers to re-enroll, accepting the operational cost of a mesh-wide re-enrollment and brief peer unavailability. If upgrading is not immediately possible, the highest-value compensating control is to remove network reachability to the control plane's /info, /enroll and /enroll/status paths from untrusted networks - front the control plane with mTLS or an authenticating ingress and firewall the enrollment endpoints to known peer subnets; the trade-off is that /info also serves legitimate peer discovery, so nodes outside the allowlist will fail to discover or enroll. Additionally, restrict router-lease authority to a small set of known router identities and monitor lease changes for unexpected multiaddr substitutions, and log and alert on high-volume or sequential peer_id requests to /enroll/status, since that pattern is the enumeration signature of this attack. Disabling POST /enroll externally where an out-of-band enrollment process exists removes the secondary re-fetch vector, at the cost of blocking self-service enrollment for new peers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the SAM control plane's enrollment status handler, HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go, and is a textbook CWE-306 (Missing Authentication for Critical Function) compounded by CWE-522 (Insufficiently Protected Credentials). The control plane hands out Biscuit tokens - attenuable, public-key-signed bearer capability tokens that peers present to authorize mesh operations - but the status handler released an approved peer's token to any caller that supplied a peer_id, and peer_ids are freely enumerable from the unauthenticated GET /info endpoint. Because the endpoint never verified that the requester actually held the enrollment private key corresponding to that peer, the token was effectively public to anyone with network reachability to the control plane. A parallel defect in POST /enroll allowed anyone holding any valid bootstrap token (not necessarily the victim's) to re-fetch another peer's credential, widening the pool of attackers beyond fully unauthenticated parties. Possession of a peer's Biscuit token is directly reusable: the token is accepted as a bearer credential on /policies, exposing the mesh's authorization rules for reconnaissance, and on /routers/lease, where a forged lease lets the attacker substitute advertised router multiaddrs and steer or disrupt peer-to-peer traffic. This matches the assessed impact profile of high confidentiality loss with limited integrity and availability effects (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L); the input CVSS 4.0 vector scores it 8.8 with the same unauthenticated, no-user-interaction characteristics. Exploitation is constrained in practice by three prerequisites: the enrollment and info endpoints must be reachable over the network, at least one approved bootstrap-enrolled peer must exist so a peer_id and token are available, and only the alpha.1 through alpha.8 builds are affected. Version 0.1.0-alpha.9 closes the class by requiring a cryptographic challenge-response proving possession of the enrollment private key before any credential is released, applying rate limiting to blunt peer_id enumeration, and validating router lease addresses; the same release also carries related hardening such as a freshness boundary on token refresh and control-plane reconciliation of peer bans.
Know when Sam gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Unauthenticated network endpoint with no user interaction gives AV:N/AC:L/PR:N/UI:N; token/policy disclosure is C:H while router-lease overwrite yields limited I:L/A:L, with no cross-system scope change.
Primary rating from Vendor (Google).
CVSS VectorVendor: Google
Lifecycle Timeline
2DescriptionCVE.org
Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow an unauthenticated remote attacker to retrieve an approved bootstrap-enrolled peer's signed Biscuit identity token by supplying a peer_id obtainable from the unauthenticated GET /info endpoint. A related flaw in POST /enroll allowed any bootstrap-token holder to re-fetch another peer's credential. An attacker can replay the disclosed Biscuit token as a bearer credential on /policies to read mesh authorization policies and on /routers/lease to overwrite advertised router multiaddrs. Users should upgrade to version 0.1.0-alpha.9 or later, which requires cryptographic proof of possession of the enrollment private key on credential-releasing endpoints, enforces rate limiting, and validates router lease addresses.
Technical POC Analysis
CWE-306 (Missing Authentication for Critical Function), with CWE-522 as the credential-exposure consequence.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Google OSS Agent Mesh (SAM) control plane releases 0.1.0-alpha.1 through 0.1.0-alpha.8 contain a credential-handling flaw that allows a signed Biscuit identity token belonging to an already-enrolled peer to be obtained and replayed, exposing mesh authorization policies and allowing the advertised router addresses to be rewritten. Any team operating a SAM alpha deployment in a lab, pilot, or early production path should treat mesh identities and routing as potentially compromised, since redirection of router leases can silently reroute agent traffic to attacker-controlled endpoints. Because this is pre-GA software with a narrow deployment base, the exposure is concentrated but consequential for those running it; no public exploit code or confirmed active exploitation was identified at time of analysis.
Apply vendor patch (0.1.0-alpha.9). Until the upgrade is complete, restrict network access to the SAM control plane so that /info, /policies, /routers/lease and /enroll are reachable only from trusted management networks, rotate and revoke bootstrap enrollment tokens and peer credentials, and monitor router lease changes for unauthorized multiaddr overwrites.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 through 0.1.0-alpha.8 allows remote attackers to self-enroll into the mesh and
Unauthenticated remote libp2p peers can bypass Biscuit capability policy enforcement in Google OSS Agent Mesh (SAM) 0.1.
Exploit-DB