Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)
Only Google SAM peers enrolled via bootstrap token from 0.1.0-alpha.1 through 0.1.0-alpha.8 are affected, and only when enrollment is auto-approved, the chart default. Fixed in 0.1.0-alpha.9.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Default setups
- Fix
- Fixed in 0.1.0-alpha.9
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow an unauthenticated remote attacker to retrieve an approved bootstrap-enrolled peer's signed Biscuit identity token by supplying a peer_id obtainable from the unauthenticated GET /info endpoint. A related flaw in POST /enroll allowed any bootstrap-token holder to re-fetch another peer's credential. An attacker can replay the disclosed Biscuit token as a bearer credential on /policies to read mesh authorization policies and on /routers/lease to overwrite advertised router multiaddrs. Users should upgrade to version 0.1.0-alpha.9 or later, which requires cryptographic proof of possession of the enrollment private key on credential-releasing endpoints, enforces rate limiting, and validates router lease addresses.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- github.com/google/sam
From 0.1.0-alpha.1 · fixed in 0.1.0-alpha.9
References 2
GitHub · google/sam
Questions about CVE-2026-103090
What does this mean?
The GET /enroll/status endpoint can be called without authentication and returns a live, control-plane-signed Biscuit credential belonging to an enrolled peer. That credential can then be replayed to read mesh authorization policies and overwrite router lease addresses.Source: github.com, github.com
Am I affected, and how do I check?
Google SAM from 0.1.0-alpha.1 up to but not including 0.1.0-alpha.9 is in the affected range. The issue applies only to peers enrolled with a bootstrap token, not to peers enrolled through OIDC, and is most relevant where enrollment is auto-approved via --auto-approve-enrollment, the chart default; check the installed version, the enrollment method, and that flag in your configuration.Source: github.com, github.com
What should I do about it?
Upgrade to v0.1.0-alpha.9, which contains the fix. The facts do not list a workaround.Source: github.com, github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data