github.com/google/sam vulnerabilities

CVEs whose affected-version data names the github.com/google/sam package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

3 CVEsRSS

CVE-2026-103090High· 8.8

1w ago

Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)

Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Goo…

▾ TwilightGoogle · github.com/google/samEPSS 0.34%via CVEORG

CVE-2026-102503Critical· 9.3PoC

1w ago

Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)

Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.…

▾ AbyssalGoogle · github.com/google/samEPSS 0.43%via CVEORG

CVE-2026-103091Critical· 9.3PoC

1w ago

Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)

Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/contro…

▾ AbyssalGoogle · github.com/google/samEPSS 0.64%via CVEORG