Skip to content
OpenAdvisories

Product · Google

SAM

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-103091

    Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)

    Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in G…

    Google SAM
  • Critical 9.3
    CVE-2026-102503

    Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)

    Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an una…

    Google SAM