Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-109799

Unverified JWT signature in SAP Cloud SDK for Python

CVSS 3.1
7.5 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-109799 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SAP Cloud SDK for Python fails to verify IAS JWT signatures in IASContextProvider, the runtime-context provider registered by default via bootstrap(app). A remote unauthenticated caller can send a self-signed JWT in the Authorization header naming a victim tenant and user. The forged app_tid, sap_gtid, and user_uuid claims are written into RuntimeContext and then flow into telemetry spans, logs, audit events, and CBCClient tenant routing.

What to do: Apply SAP's update for CVE-2026-109799. SAP has not listed a fixed version or workaround.

ProductAffected
SAP Cloud SDK for Python—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in IASContextProvider, the runtime-context provider registered by default via bootstrap(app).IASContextProvider extracted the app_tid, sap_gtid and user_uuid claims from the IAS JWT in the Authorization header using an unverified decoder and wrote them into the request-scoped RuntimeContext without validating the token signature. A remote caller could submit a self-signed JWT naming a victim tenant/user; the forged identity then propagated to every consumer of the runtime context:OTel span attributes (sap.tenancy.tenant_id, user.id) via RuntimeContextSpanProcessorlog records via IdentityLogFilteraudit events (tenant_id, user_initiator_id) via AuditClienttenant routing via CBCClientThis completes an earlier remediation that fixed the same unverified pattern in StarletteIASTelemetryMiddleware but did not cover IASContextProvider.

Weakness
CWE-347
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories