CVE-2026-102503

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 are vulnerable to missing authentication and authorization in the /libp2p-http ingress server. Specifically, the StartIngressServer function in cmd/sam-node/node.go fails to verify Biscuit tokens or mesh enrollment, allowing...

EUVD-2026-104049

Missing Authentication for Critical Function CWE-306 and Missing Authorization CWE-862 in the /libp2p-http ingress server StartIngressServer in cmd/sam-node/node.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass...