What happened
The control-plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 through 0.1.0-alpha.8 is missing authentication (CWE-306) and insufficiently protects credentials (CWE-522). An unauthenticated remote attacker can supply a peer_id obtained from the unauthenticated GET /info endpoint to retrieve an approved bootstrap-enrolled peer's signed Biscuit identity token; a related flaw in POST /enroll lets any bootstrap-token holder re-fetch another peer's credential. The disclosed token can be replayed as a bearer credential on /policies to read mesh authorization policies and on /routers/lease to overwrite advertised router multiaddrs.
Why it matters
SAM is a Google OSS agent-mesh for peer-to-peer agent communication; leaking a peer's signed identity token lets an outsider forge that peer's identity in the mesh, read the authorization policy and hijack routing (router multiaddr overwrite) — an unauthenticated path to disrupt or impersonate agents in a mesh deployment.
Attack vector
Unauthenticated GET /enroll/status (and POST /enroll) to harvest a peer's signed Biscuit identity token, then replay it as a bearer credential on /policies and /routers/lease.
Affected systems
Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 through 0.1.0-alpha.8
Mitigation
Upgrade to SAM 0.1.0-alpha.9 or later, which requires cryptographic proof of possession of the enrollment private key on credential-releasing endpoints, enforces rate limiting, and validates router lease addresses.