Google SAM CVE-2026-103091

Requires a reachable SAM control plane running an affected version (0.1.0-alpha.1 through 0.1.0-alpha.8) with the shipped default policy that binds sam:system:authenticated to wildcard services and targets, the OIDC registration flow exposed (public GET /info and POST /register), and the attacker possessing any OIDC token accepted by the configured provider. The chief limiting factor is that /register auto-enrolls 'any valid OIDC token holder' with no claim filtering or ban checks - so realistic risk hinges on whether the configured OIDC provider allows an attacker to self-obtain a valid token; if it does, exploitation is effectively remote-unauthenticated. Upgrading to 0.1.0-alpha.9+ closes this via a fail-closed default policy, explicit policy-binding requirements on enrollment, and ban checks.

All signals point to a genuine high-priority flaw rather than a CVSS-inflated non-issue, though the affected product is early-stage. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, no-interaction attack with high confidentiality, integrity, and availability impact on the vulnerable system (VC:H/VI:H/VA:H), consistent with the description of full read/write/execute access across backend MCP nodes. The combination of Missing Authorization (CWE-862) and an insecure default policy binding sam:system:authenticated to wildcard services and targets means exploitation is a direct consequence of shipped defaults, not a misconfiguration. However, no EPSS score, CISA KEV listing, or POC was provided in the input, so the weaponization/active-exploitation dimension is unknown - the PR:N rating also carries a nuance: the description notes the attacker must present a 'valid OIDC token,' so effective unauthenticated exploitation depends on whether the configured OIDC provider permits public/self-service token issuance. Overall this is a real priority for any SAM operator, tempered by the product being alpha-stage with a correspondingly small real-world footprint; threat-actor interest is unquantified absent EPSS/KEV data.

An attacker who holds any OIDC token accepted by the mesh's configured provider queries the public GET /info endpoint to discover the OIDC configuration, then calls POST /register, which auto-enrolls the token holder with no claim filtering or ban checks. Because the default policy grants sam:system:authenticated wildcard access, the attacker immediately obtains a mesh credential and invokes arbitrary tools across all connected MCP backend nodes. No public exploit identified at time of analysis; the low attack complexity (AC:L) and lack of user interaction make exploitation straightforward once a valid OIDC token is obtained.