{"metadata": {"vulnerability": "CVE-2026-102503", "count": 20, "kinds": {"milestone": 4, "sighting": 7, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-04T06:09:00Z", "date_only": false, "value": "2026-09-04T06:09:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / Google", "record": "CVE-2026-102503", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-29T11:07:35.558Z", "date_only": false, "value": "2026-09-29T11:07:35.558Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-102503", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-19T02:20:35.753Z", "date_only": false, "value": "2026-10-19T02:20:35.753Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-102503", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-19T02:20:35.753Z", "date_only": false, "value": "2026-10-19T02:20:35.753Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Google", "record": "CVE-2026-102503", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T03:16:58Z", "date_only": false, "value": "2026-10-19T03:16:58Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-VC9X-QG3J-CXG6", "record": "GHSA-VC9X-QG3J-CXG6", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-19T03:16:58.193Z", "date_only": false, "value": "2026-10-19T03:16:58.193", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102503", "record": "FKIE_CVE-2026-102503", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-19T03:31:05Z", "date_only": false, "value": "2026-10-19T03:31:05Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VC9X-QG3J-CXG6", "record": "GHSA-VC9X-QG3J-CXG6", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-19T04:07:14.433Z", "date_only": false, "value": "2026-10-19T04:07:14.433200Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3my7an3uozd2q", "record": "CVE-2026-102503", "field": "creation_timestamp", "uuid": "8533efa5-088d-41b3-9038-4ec7f52a8594", "content": "\ud83d\udea8 CVE-2026-102503 \u2014 CVSS 9.3 CRITICAL\n\nMissing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-h...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-102503\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3my7an3uozd2q"}, {"timestamp": "2026-10-19T04:10:04.042Z", "date_only": false, "value": "2026-10-19T04:10:04.042056Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3my7as5bhiq24", "record": "CVE-2026-102503", "field": "creation_timestamp", "uuid": "52e7062d-78bb-42c9-a326-c09ae230c687", "content": "CVE-2026-102503 - sam\nVersions 0.1.0-alpha.1 and 0.1.0-alpha.2 of Google\u2019s open\u2011source Agent Mesh let any remote peer call backend services without proving its identity. This can let attackers bypass policy\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#sam #google #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3my7as5bhiq24"}, {"timestamp": "2026-10-19T04:10:04.046Z", "date_only": false, "value": "2026-10-19T04:10:04.046658Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3my7as5bhiq24", "record": "CVE-2026-102503", "field": "creation_timestamp", "uuid": "9c559a34-3ac0-4f91-9737-4860b22df6e4", "content": "CVE-2026-102503 - sam\nVersions 0.1.0-alpha.1 and 0.1.0-alpha.2 of Google\u2019s open\u2011source Agent Mesh let any remote peer call backend services without proving its identity. This can let attackers bypass policy\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#sam #google #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3my7as5bhiq24"}, {"timestamp": "2026-10-19T04:30:29.129Z", "date_only": false, "value": "2026-10-19T04:30:29.129928Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3my7bwnf44e2l", "record": "cve-2026-102503", "field": "creation_timestamp", "uuid": "30512049-6d58-42b7-87aa-891a696ce0b6", "content": "Google SAM versions 0.1.0-alpha.1 \u2013 0.1.0-alpha.2: CRITICAL vuln (CVE-2026-102503) allows unauthenticated remote access to backend services. Upgrade to 0.1.0-alpha.3+ now. https://radar.offseq.com/threat/cve-2026-102503-cwe-306-missing-authentication-for-critical-function-in-google-sam-5242cb38ae...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3my7bwnf44e2l"}, {"timestamp": "2026-10-19T04:30:29.134Z", "date_only": false, "value": "2026-10-19T04:30:29.134038Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3my7bwnf44e2l", "record": "cve-2026-102503", "field": "creation_timestamp", "uuid": "eed698f8-f76f-446c-9342-4c89bb04166a", "content": "Google SAM versions 0.1.0-alpha.1 \u2013 0.1.0-alpha.2: CRITICAL vuln (CVE-2026-102503) allows unauthenticated remote access to backend services. Upgrade to 0.1.0-alpha.3+ now. https://radar.offseq.com/threat/cve-2026-102503-cwe-306-missing-authentication-for-critical-function-in-google-sam-5242cb38ae...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3my7bwnf44e2l"}, {"timestamp": "2026-10-19T05:02:05.216Z", "date_only": false, "value": "2026-10-19T05:02:05.216427Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3my7dp5pmvq25", "record": "CVE-2026-102503", "field": "creation_timestamp", "uuid": "f4888916-54f7-4ef9-a801-ee76b8467e9f", "content": "Daily IT Security Digest \u2014 2026-10-19\nEUVD-2026-104050 and CVE-2026-102503) allows remote attackers to bypass authentication policies and invoke backend services directly. Update to SAM v0.1.0-alpha.3+ immediately if still running prior versions.", "url": "https://bsky.app/profile/hermes71.bsky.social/post/3my7dp5pmvq25"}, {"timestamp": "2026-10-19T05:02:05.218Z", "date_only": false, "value": "2026-10-19T05:02:05.218258Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3my7dp5pmvq25", "record": "CVE-2026-102503", "field": "creation_timestamp", "uuid": "228cff46-e2cc-4154-be09-278d0d71a0c3", "content": "Daily IT Security Digest \u2014 2026-10-19\nEUVD-2026-104050 and CVE-2026-102503) allows remote attackers to bypass authentication policies and invoke backend services directly. Update to SAM v0.1.0-alpha.3+ immediately if still running prior versions.", "url": "https://bsky.app/profile/hermes71.bsky.social/post/3my7dp5pmvq25"}, {"timestamp": "2026-10-19T17:46:04.092Z", "date_only": false, "value": "2026-10-19T17:46:04.092443Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-102503", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-19T17:46:04.092Z", "date_only": false, "value": "2026-10-19T17:46:04.092443Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102503", "record": "FKIE_CVE-2026-102503", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-19T17:46:47.397Z", "date_only": false, "value": "2026-10-19T17:46:47.397Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-102503", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-19T17:46:47.397Z", "date_only": false, "value": "2026-10-19T17:46:47.397Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-102503", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T18:32:06Z", "date_only": false, "value": "2026-10-19T18:32:06Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VC9X-QG3J-CXG6", "record": "GHSA-VC9X-QG3J-CXG6", "field": "modified"}, {"timestamp": "2026-10-19T21:13:39.973Z", "date_only": false, "value": "2026-10-19T21:13:39.973", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102503", "record": "FKIE_CVE-2026-102503", "field": "lastModified"}], "metrics": {"as_of": "2026-10-30T19:46:08.078Z", "anchors": {"origin": {"timestamp": "2026-09-04T06:09:00Z", "date_only": false, "value": "2026-09-04T06:09:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / Google", "record": "CVE-2026-102503", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-09-04T06:09:00Z", "date_only": false, "value": "2026-09-04T06:09:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / Google", "record": "CVE-2026-102503", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 4887428.078783, "hours": 1357.6189107730556, "days": 56.56745461554398, "min_seconds": 4887428.078783, "max_seconds": 4887428.078783, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-04T06:09:00Z", "date_only": false, "value": "2026-09-04T06:09:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / Google", "record": "CVE-2026-102503", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-30T19:46:08.078Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}