OpenSandbox Go SDK forwards tenant keys through the wrong proxy headers, enabling unauthorized access from inside the sandbox
When UseServerProxy mode is enabled, the Go SDK does not follow the security convention of placing the tenant API Key in the OPEN-SANDBOX-API-KEY header for server-side authentication. Instead, it injects the key into forwarded headers marked as non-sensitive, such as X-EXECD-ACCESS-TOKEN and OPENSANDBOX-EGRESS-AUTH, so the credential leaks with the request directly into the untrusted sandbox environment. An attacker can use this credential from inside the sandbox to make malicious calls to the lifecycle API and create, inspect, pause, or delete every sandbox instance under the same tenant, seriously undermining system isolation and data confidentiality.
Component
OpenSandbox is a cloud-native sandbox platform that provides isolated execution environments. Its core architecture includes a lifecycle server and data-plane components designed for multi-tenant resource scheduling and secure code isolation. The Go SDK is the client integration module that establishes communication with the server and manages the lifecycle state of sandbox instances.
Type
Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Refactor the authentication logic in the SDK's proxy mode so that sensitive headers are stripped only in direct mode, while proxy mode strictly uses the dedicated authentication header to pass the key. Also improve header filtering to stop sensitive credentials from passing through into the sandbox, and add automated regression tests that verify credential isolation in every deployment mode.
CSSA Exclusive Early Warning
10.0 Critical
dspy Local component binds to all networks by default and lacks authentication, creating unauthorized access risk
An attacker exploits the flaw that the dspy.Local component hard-codes the host address to 0.0.0.0 during initialization and configures no server-side identity verification. By sending HTTP requests to the target port over the network, the attacker can bypass authentication and directly access protected management routes and model endpoints. Because the service is exposed to the entire LAN by default and lacks an effective IP allowlist or token validation logic, any malicious node on the same network segment can run unauthorized model queries or state probes, which may lead to sensitive data disclosure, malicious consumption of compute resources, or reduced service availability.
Component
dspy is a declarative programming framework developed by the Stanford NLP lab that aims to simplify building and optimizing large language model applications. Its core architecture includes a module for launching local model services, which dynamically deploys and manages a local inference engine at runtime and handles inference requests through OpenAI-compatible API endpoints. It mainly serves private deployments that need low latency and high controllability, meeting developers' needs for fine-grained control of model behavior and trace tracking.
Type
Missing Authentication for Critical Function (CWE-306)
Change the default bind address to 127.0.0.1 to restrict access to the local host, and introduce mandatory API key authentication for external access. Also add timeout control parameters during connection setup and adopt an atomic port allocation strategy to eliminate time-of-check to time-of-use flaws, ensuring the service starts securely and reliably.
CSSA Exclusive Early Warning
10.0 Critical
Missing authentication for critical functions in deep-searcher leads to remote arbitrary file read and service configuration hijacking
Without any authentication, an attacker can directly access unprotected endpoints over the network, use the /load-files/ interface to read sensitive files at arbitrary paths on the server, or use /load-website/ to send SSRF requests that probe internal resources. More seriously, the attacker can call /set-provider-config/ to tamper with the Provider configuration of the LLM or Embedding service and redirect processing traffic to a malicious server, stealing previously loaded file contents and API keys in later queries, causing data disclosure and loss of system control.
Component
deep-searcher is an intelligent search and analysis platform built on the FastAPI framework that integrates large language models with vector databases for efficient retrieval of unstructured data. Its core architecture supports local file loading, web crawling, and multimodal data processing, mainly serving internal enterprise knowledge management and automated Q&A scenarios, and relies on open network interfaces to provide API services for front-end and back-end interaction.
Type
Missing Authentication for Critical Function (CWE-306)
Developers should enforce strict authentication, such as JWT tokens or API Key validation, in front of every API endpoint. Also restrict the range of readable file paths, disable resolution of dangerous internal loopback addresses, and add allowlist validation and audit logging for changes to third-party service configuration.
CVE Intelligence
2
CVE-2026-102503
CVSS
9.8 Critical
2026-10-19
Authentication bypass in Google OSS Agent Mesh allows arbitrary backend service invocation
In Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2, the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) contains missing authentication for critical function (CWE-306) and missing authorization (CWE-862) flaws. The vulnerability lets unauthenticated remote libp2p peers bypass Biscuit capability policy enforcement and invoke any registered backend service, including command/stdio-based MCP servers, A2A, and inference endpoints. Although the MCP protocol stream handler enforces WithBiscuitAuth and Authorize checks, the parallel /libp2p-http ingress route forwards requests directly to backend service handlers without validating Biscuit tokens or mesh registration status. All SAM users who have not upgraded to 0.1.0-alpha.3 or later are affected. An attacker can trigger it remotely without authentication and directly access protected backend services.
Component
Google OSS Agent Mesh (SAM) is an open-source agent mesh framework for connecting and managing distributed agents, MCP servers, and inference endpoints, communicating over the libp2p protocol.
Risks
Unauthorized access to backend services: An attacker can bypass authentication and directly invoke any registered backend service, including sensitive MCP servers and inference endpoints
Arbitrary code execution risk: If backend services include command- or stdio-based MCP servers, an attacker may trigger command execution with crafted requests, leading to remote code execution
Data disclosure and integrity damage: An attacker can access or tamper with sensitive data transmitted through the mesh, undermining system confidentiality and integrity
Unauthenticated attack: An attacker needs no credentials; network reachability alone is enough to exploit the vulnerability
Immediately upgrade to Google OSS Agent Mesh (SAM) 0.1.0-alpha.3 or later
Restrict access to the /libp2p-http port at the firewall or network layer so that only trusted peers can connect
Monitor backend service logs for anomalous calls to identify unauthorized access attempts
CVE-2026-103091
CVSS
9.8 Critical
2026-10-19
Authentication bypass in Google OSS Agent Mesh leads to remote code execution
In Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8, the MCP proxy (HandleStreamPassThrough in mcp_service.go) and the OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) contain missing authorization (CWE-862) and initialization of a resource with an insecure default (CWE-1188) flaws. Because GET /info publicly discloses the OIDC configuration, POST /register automatically registers any user holding a valid OIDC token without claim filtering or ban checks, and the default policy binds sam:system:authenticated to wildcard services and targets, an attacker can obtain mesh credentials with full read, write, and execute access to backend services. This lets a remote attacker self-register into the mesh and invoke arbitrary tools on every connected MCP backend node. All Google OSS Agent Mesh users not updated to 0.1.0-alpha.9 are affected. An attacker only needs a valid OIDC token to trigger the vulnerability and can control backend services remotely without further interaction.
Component
Google OSS Agent Mesh (SAM) is an open-source agent mesh system for connecting and managing MCP backend nodes, supporting authentication and registration through OIDC.
Risks
Complete system control: An attacker can execute arbitrary code on the victim system and, depending on user privileges, install programs, view/change/delete data, or create new fully privileged accounts
Remote unauthorized access: An attacker can self-register into the mesh with crafted requests and obtain full read, write, and execute permissions on backend services
No user interaction: An attacker only needs a valid OIDC token to trigger the vulnerability and can achieve remote control without any further interaction from the target user
Immediately upgrade to 0.1.0-alpha.9 or later, which enforces a fail-closed default policy, requires explicit policy bindings at registration, and adds ban checks
Monitor for anomalous registrations and unauthorized MCP tool invocation logs
Apply access control to OIDC configuration information to avoid publicly disclosing sensitive configuration
Package Poisoning
6
Package Poisoning
npm2026-10-19
ichigo-baileys@1.0.5
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
ab890c13cfdaf13b068eec56d5c6d69f
Package Poisoning
npm2026-10-19
prastzy@1.0.0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
4c21aaa35cd9629ce8f9ea766da84f0d
Package Poisoning
npm2026-10-19
prastzyy@1.0.0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
c253272bfe12f09630a8eecaa456d0ad
Package Poisoning
npm2026-10-19
rubbydev-crash-baileys@1.0.0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
b1f82e942dc84c2fbfa6dd38917b1b44
Package Poisoning
npm2026-10-19
aldi02-baileys@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
56d2d782edfd2303c24a98fa964ea3e1
Package Poisoning
npm2026-10-19
item-validator@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
