Google SAM

• CVE-2026-103090 High 8.8 Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM) 0.5%
• CVE-2026-103091 Critical 9.3 Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM) 0.6%
• CVE-2026-102503 Critical 9.3 Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM) 0.4%