CVE-2026-103090 - Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)
CVE ID :CVE-2026-103090 Published : Oct. 21, 2026, 11:17 p.m. | 49 minutes ago Description :Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in...