CVE-2026-103090 Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)

Missing Authentication for Critical Function CWE-306 and Insufficiently Protected Credentials CWE-522 in the control plane enrollment status handler HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha....

CVE-2026-103090

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 are vulnerable to unauthenticated Biscuit credential disclosure . The root cause is missing authentication and insufficiently protected credentials in the control plane enrollment status handler (HandleEnrollStatus at GET /e...