CVE-2026-103091

{
  "etk_id": "ETK-2026-2030",
  "cve_id": "CVE-2026-103091",
  "display_id": "CVE-2026-103091",
  "ghsa_id": "GHSA-qx8v-pq9p-7g7v",
  "euvd_id": "EUVD-2026-104050",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Google SAM enrollment and MCP proxy",
  "summary": "Google SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.8 can enroll holders of valid OIDC tokens without adequate authorization checks and grant overly broad default access. An enrolled attacker may invoke tools on connected MCP backends and access backend services.",
  "mitigation": "Upgrade Google SAM to version 0.1.0-alpha.9 or later. Until upgraded, restrict enrollment and access to the affected services to trusted identities and networks.",
  "vendor": "Google",
  "product": "SAM",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.1.0-alpha.1, < 0.1.0-alpha.9"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "0.1.0-alpha.9"
      ],
      "package_name": "github.com/google/sam",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "epss_score": 0.005,
  "epss_percentile": 0.4135,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 39.168145833333334,
  "t0_at": "2026-10-19T02:24:35.225000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-19T04:49:05.820408+00:00",
      "days": 0.10035411351851851,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T02:24:35.225000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-19T02:24:35.225000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T02:24:35.225000+00:00",
      "url": "https://github.com/advisories/GHSA-qx8v-pq9p-7g7v"
    }
  }
}