Google SAM Auth Bypass Lets Attackers Steal Tokens in Alpha Versions
Unauthenticated access to enrollment endpoints in Google SAM versions prior to 0.1.0-alpha.9 exposes signed identity tokens and authorization policies to remote attackers.
Key points
- CVE-2026-103090 allows unauthenticated retrieval of signed Biscuit tokens via the enrollment status handler.
- Attackers can use stolen tokens to read mesh policies or overwrite router lease addresses.
- Google released version 0.1.0-alpha.9 to fix the missing authentication and credential protection flaws.
Google has released a patch for a high-severity authentication bypass in its open-source Agent Mesh (SAM) project. The flaw, tracked as CVE-2026-103090, affects versions 0.1.0-alpha.1 through 0.1.0-alpha.8 and allows unauthenticated remote attackers to steal signed identity tokens from enrolled peers.
What happened
The vulnerability resides in the control plane enrollment status handler, specifically the HandleEnrollStatus function at the GET /enroll/status endpoint in internal/controlplane/server.go. According to the NVD record, this flaw combines missing authentication for critical functions with insufficiently protected credentials. An attacker can obtain a peer_id from the unauthenticated GET /info endpoint. Using that identifier, they can retrieve an approved bootstrap-enrolled peer's signed Biscuit identity token without providing any credentials.
A related issue in the POST /enroll endpoint allowed any holder of a bootstrap token to re-fetch another peer's credential. This combination of flaws means an attacker does not need to compromise the enrollment process itself. They only need to obtain valid peer identifiers, which are exposed via public endpoints. The stolen Biscuit token serves as a bearer credential for further access within the mesh network.
Why it matters
The exposure of signed Biscuit tokens enables significant lateral movement and configuration tampering within the mesh. According to the advisory, an attacker can replay the disclosed token on the /policies endpoint to read mesh authorization policies. This reveals the authorization policies of the mesh. Furthermore, the token can be used on the /routers/lease endpoint to overwrite advertised router multiaddrs. This allows an attacker to modify the advertised router multiaddrs.
The CVSS score of 8.8 classifies this as a high-severity issue. The weaknesses are categorized as CWE-306 (Missing Authentication for Critical Function) and CWE-522 (Insufficiently Protected Credentials). These flaws indicate that the control plane did not adequately verify the identity of the requester before releasing sensitive cryptographic material. The source material does not provide context on why this oversight occurred or if it is common in alpha releases.
Our take on the response
- Upgrade to version 0.1.0-alpha.9 or later immediately.
- Verify that all peers have restarted their agents to enforce the new authentication requirements.
- Audit logs for unauthorized access to the /enroll/status and /info endpoints.
- Review router lease configurations for unexpected changes or unauthorized multiaddrs.
What defenders should look for
Teams should monitor for unauthenticated requests to enrollment and information endpoints, particularly from unexpected source IPs. Look for anomalies in token usage, such as a single peer ID generating multiple credential requests or accessing policy endpoints without prior enrollment activity. Check for sudden changes in router advertisements or multiaddr configurations, which may indicate token abuse. If suspicious activity is detected, isolate affected nodes and rotate any potentially compromised credentials to prevent further lateral movement or configuration tampering within the mesh.
Background: Lateral movement
Lateral movement is the process where an attacker navigates from one system to another within a network after initial access. They use stolen credentials or unpatched vulnerabilities to expand their reach. This tactic allows them to reach sensitive data or critical servers without triggering perimeter alarms, making internal monitoring the primary defense.
Read the full guide: Lateral Movement in Cybersecurity: Definition and Detection
What to do and how to stay safe
- Check your current Google SAM version and upgrade to 0.1.0-alpha.9 if you are running an earlier alpha release.
- Review access logs for the /enroll/status and /info endpoints to identify any un
Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget
General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.
