github.com/google/sam vulnerabilities

CVEs whose affected-version data names the github.com/google/sam package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

2 CVEsRSS

CVE-2026-102503Critical· 9.3

today

Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)

Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.…

▾ MidnightGoogle · github.com/google/samvia CVEORG

CVE-2026-103091Critical· 9.3

today

Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)

Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/contro…

▾ MidnightGoogle · github.com/google/samvia CVEORG