{"metadata": {"vulnerability": "CVE-2026-103090", "count": 11, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-09-06T16:01:00Z", "date_only": false, "value": "2026-09-06T16:01:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / Google", "record": "CVE-2026-103090", "field": "containers.cna.datePublic"}, {"timestamp": "2026-09-30T01:36:22.449Z", "date_only": false, "value": "2026-09-30T01:36:22.449Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-103090", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-21T22:16:59.777Z", "date_only": false, "value": "2026-10-21T22:16:59.777Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-103090", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-21T22:16:59.777Z", "date_only": false, "value": "2026-10-21T22:16:59.777Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-103090", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-21T22:16:59.777Z", "date_only": false, "value": "2026-10-21T22:16:59.777Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Google", "record": "CVE-2026-103090", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-21T22:28:01.141Z", "date_only": false, "value": "2026-10-21T22:28:01.141943Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117481254450575270", "record": "CVE-2026-103090", "field": "creation_timestamp", "uuid": "7803934b-4beb-4ef3-955f-37969bba78ab", "content": "CVE-2026-103090 Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM) Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow an unauthenticated remote attacker to retrieve an approved bootstrap-enrolled peer's signed Biscuit identity token by supplying a peer_id obtainable from the unauthenticated GET /info endpoint. A related flaw in POST /enroll allowed any bootstrap-token holder to re-fetch another peer's credential. An attacker can replay the disclosed Biscuit token as a bearer credential on /policies to read mesh authorization policies and on /routers/lease to overwrite advertised router multiaddrs. Users should upgrade to version 0.1.0-alpha.9 or later, which requires cryptographic proof of possession of the enrollment private key on credential-releasing endpoints, enforces rate limiting, and validates router lease addresses.\nhttps://www.cve.org/CVERecord?id=CVE-2026-103090https://github.com/google/sam/security/advisories/GHSA-hp3x-79wr-rx66https://github.com/google/sam/releases/tag/v0.1.0-alpha.9#Google #SAM#CVE_2026_103090#bot", "url": "https://infosec.exchange/users/cve/statuses/117481254450575270"}, {"timestamp": "2026-10-21T23:17:24Z", "date_only": false, "value": "2026-10-21T23:17:24Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-XHG2-HV24-F4RP", "record": "GHSA-XHG2-HV24-F4RP", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-21T23:17:24.990Z", "date_only": false, "value": "2026-10-21T23:17:24.990", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103090", "record": "FKIE_CVE-2026-103090", "field": "published"}, {"timestamp": "2026-10-22T00:31:59Z", "date_only": false, "value": "2026-10-22T00:31:59Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-XHG2-HV24-F4RP", "record": "GHSA-XHG2-HV24-F4RP", "field": "published"}, {"timestamp": "2026-10-22T00:31:59Z", "date_only": false, "value": "2026-10-22T00:31:59Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-XHG2-HV24-F4RP", "record": "GHSA-XHG2-HV24-F4RP", "field": "modified"}, {"timestamp": "2026-10-22T16:18:19.040Z", "date_only": false, "value": "2026-10-22T16:18:19.040", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103090", "record": "FKIE_CVE-2026-103090", "field": "lastModified"}]}