Reference page — cumulative record through Tuesday, October 20, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-102503

CVE-2026-102503CRITICAL

Google SAM — Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0034   26.1     —

AFFECTED
  Product  Versions         Fixed
  SAM      0.1.0-alpha.1 –  —

TIMELINE
  Sep 29  Reserved by Google
  Oct 19  EXPLOIT PUBLISHED — CVE-2026-102503 (Google SAM). Public exploit reference added.
  Oct 19  Published (CNA: Google)

CWE-306, CWE-862 · CNA: Google · CVSS v4.0 · 4 references · NVD status: Awaiting Analysis

Description

Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services (including command/stdio-backed MCP servers, A2A, and inference endpoints). While the MCP protocol stream handler enforces WithBiscuitAuth and Authorize checks, the parallel /libp2p-http ingress routes requests directly to backend service handlers without verifying a Biscuit token or mesh enrollment. Users should upgrade to version 0.1.0-alpha.3 or later.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
September 29, 2026	Reserved	Reserved by Google
October 19, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-102503 (Google SAM). Public exploit reference added.
October 19, 2026	Published	Published (CNA: Google)

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Google	SAM	—	0.1.0-alpha.1	—

Weaknesses

CWE-306 · CWE-862

References (4)

Authoritative record: CVE-2026-102503 at cve.org

Vendors: google

Weaknesses: CWE-306 · CWE-862

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-102503 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Tuesday, October 20, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.