A missing authentication check in the enrollment status handler and insufficient protection of Biscuit identity tokens allow an attacker who can reach the /enroll/status endpoint to retrieve a signed token for a bootstrap‑enrolled peer. The disclosed token can be replayed as a bearer credential on /policies to read authorization rules and on /routers/lease to overwrite advertised router addresses, effectively granting unauthorized control of the mesh.

The vulnerability affects Google’s OSS Agent Mesh (SAM) versions starting at 0.1.0‑alpha.1 up through 0.1.0‑alpha.8. The security fix is included in version 0.1.0‑alpha.9 and later, which enforces cryptographic proof of key possession on credential‑releasing endpoints, adds rate limiting, and validates router lease addresses.

The CVSS score of 8.8 indicates a high‑severity issue, and while the EPSS score is not reported, the lack of authentication makes exploitation straightforward for any network‑reachable attacker. The vulnerability is not listed in CISA's KEV catalog, but the attack surface and the potential to modify network topology and access authentication policies make it a significant threat.