SAM vulnerabilities

3 known vulnerabilities in SAM from Google. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  SAM: Missing Authentication for Critical Functionality

  CVE-2026-103090Oct 21, 2026Google

  Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM

• 9.3 Critical severity

  SAM: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-103091Oct 19, 2026Google

  Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in Go

• 9.3 Critical severity

  SAM: Missing Authentication for Critical Functionality

  CVE-2026-102503Oct 19, 2026Google

  Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unau