Sam
Monthly
Unauthenticated remote attackers can retrieve a signed Biscuit identity token belonging to any approved, bootstrap-enrolled peer from the Google OSS Agent Mesh (SAM) control plane in versions 0.1.0-alpha.1 through 0.1.0-alpha.8, then replay it as a bearer credential to read mesh authorization policies via /policies and to overwrite advertised router multiaddrs via /routers/lease. The chain requires only the peer_id that the unauthenticated GET /info endpoint discloses, so no credentials or user interaction are needed; a related POST /enroll flaw let any bootstrap-token holder re-fetch another peer's credential. Vendor-released patch: 0.1.0-alpha.9, which enforces cryptographic proof of possession of the enrollment private key on credential-releasing endpoints, adds rate limiting, and validates router lease addresses; no public exploit code or confirmed active exploitation was identified at time of analysis.
Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 through 0.1.0-alpha.8 allows remote attackers to self-enroll into the mesh and invoke arbitrary tools across every connected MCP backend node. The control plane exposes GET /info publicly, auto-enrolls any valid OIDC token holder via POST /register without claim filtering or ban checks, and ships a default policy binding sam:system:authenticated to wildcard services and targets, so a token holder can obtain a mesh credential with full read, write, and execution access. No public exploit code or active exploitation is confirmed at time of analysis, though the CVSS vector is PR:N and practical risk depends on whether the configured OIDC provider lets an attacker self-obtain a valid token; upgrading to 0.1.0-alpha.9 enforces fail-closed defaults, explicit policy-binding requirements on enrollment, and ban checks.
Unauthenticated remote libp2p peers can bypass Biscuit capability policy enforcement in Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 and 0.1.0-alpha.2 through the /libp2p-http ingress server, invoking arbitrary registered backend services including command/stdio-backed MCP servers, A2A, and inference endpoints. The defect is a missing-authentication and missing-authorization flaw in StartIngressServer (cmd/sam-node/node.go): unlike the MCP stream handler, the ingress path routes requests to backend handlers without verifying a Biscuit token or mesh enrollment. CVSS 4.0 scores this 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H); no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor has released a fixed version.
Unauthenticated remote attackers can retrieve a signed Biscuit identity token belonging to any approved, bootstrap-enrolled peer from the Google OSS Agent Mesh (SAM) control plane in versions 0.1.0-alpha.1 through 0.1.0-alpha.8, then replay it as a bearer credential to read mesh authorization policies via /policies and to overwrite advertised router multiaddrs via /routers/lease. The chain requires only the peer_id that the unauthenticated GET /info endpoint discloses, so no credentials or user interaction are needed; a related POST /enroll flaw let any bootstrap-token holder re-fetch another peer's credential. Vendor-released patch: 0.1.0-alpha.9, which enforces cryptographic proof of possession of the enrollment private key on credential-releasing endpoints, adds rate limiting, and validates router lease addresses; no public exploit code or confirmed active exploitation was identified at time of analysis.
Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 through 0.1.0-alpha.8 allows remote attackers to self-enroll into the mesh and invoke arbitrary tools across every connected MCP backend node. The control plane exposes GET /info publicly, auto-enrolls any valid OIDC token holder via POST /register without claim filtering or ban checks, and ships a default policy binding sam:system:authenticated to wildcard services and targets, so a token holder can obtain a mesh credential with full read, write, and execution access. No public exploit code or active exploitation is confirmed at time of analysis, though the CVSS vector is PR:N and practical risk depends on whether the configured OIDC provider lets an attacker self-obtain a valid token; upgrading to 0.1.0-alpha.9 enforces fail-closed defaults, explicit policy-binding requirements on enrollment, and ban checks.
Unauthenticated remote libp2p peers can bypass Biscuit capability policy enforcement in Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 and 0.1.0-alpha.2 through the /libp2p-http ingress server, invoking arbitrary registered backend services including command/stdio-backed MCP servers, A2A, and inference endpoints. The defect is a missing-authentication and missing-authorization flaw in StartIngressServer (cmd/sam-node/node.go): unlike the MCP stream handler, the ingress path routes requests to backend handlers without verifying a Biscuit token or mesh enrollment. CVSS 4.0 scores this 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H); no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor has released a fixed version.