CVE-2026-109799— Improper verification of JWT signature in IASContextProvider leads to tenant/user identity spoofing ( sap-cloud-sdk (pip))

Quick assessment

Affected

SAP_SE SAP Cloud SDK for Python

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SAP Cloud SDK for Python 的 IASContextProvider 组件中存在一个不安全的密码学签名验证漏洞（CWE-347）。该组件是通过 bootstrap(app) 默认注册的运行时上下文提供者。IASContextProvider 使用未经验证的解码器，从 Authorization 请求头中的 IAS JWT 令牌提取 app_tid、sap_gtid 和 user_uuid 声明，并将其写入请求作用域的 RuntimeContext，而在此过程中未对令牌签名进行验证。远程调用者

CVSS 7.5 · High Updated Nov 10, 2026

Possible ATT&CK Techniques 3 AI

T1190 · Exploit Public-Facing Application T1538 · Cloud Service Dashboard T1552 · Unsecured Credentials

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Improper verification of JWT signature in IASContextProvider leads to tenant/user identity spoofing ( sap-cloud-sdk (pip))

Source: CVE Program / CVE List V5

Vulnerability Description

The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in IASContextProvider, the runtime-context provider registered by default via bootstrap(app).IASContextProvider extracted the app_tid, sap_gtid and user_uuid claims from the IAS JWT in the Authorization header using an unverified decoder and wrote them into the request-scoped RuntimeContext without validating the token signature. A remote caller could submit a self-signed JWT naming a victim tenant/user; the forged identity then propagated to every consumer of the runtime context:OTel span attributes (sap.tenancy.tenant_id, user.id) via RuntimeContextSpanProcessorlog records via IdentityLogFilteraudit events (tenant_id, user_initiator_id) via AuditClienttenant routing via CBCClientThis completes an earlier remediation that fixed the same unverified pattern in StarletteIASTelemetryMiddleware but did not cover IASContextProvider.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

密码学签名的验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
SAP_SE	SAP Cloud SDK for Python	< 0.63.1	-

II. Public POCs for CVE-2026-109799

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-109799

请登录查看更多情报信息。

Other References for CVE-2026-109799 (1)

https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-93m8-crj2-v997

https://www.cve.org/CVERecord?id=CVE-2026-109799

Same Patch Batch · SAP_SE · 2026-11-10 · 40 CVEs total

CVE-2026-76964	10.0 CRITICAL	Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager)
CVE-2026-120017	10.0 CRITICAL	Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)
CVE-2026-89126	10.0 CRITICAL	Memory Corruption vulnerability in SAP Web Dispatcher
CVE-2026-89103	10.0 CRITICAL	Broken Access Control in SAP Gateway
CVE-2026-76965	9.9 CRITICAL	OS Command Injection vulnerability in ABAP Application Server for SAP NetWeaver and ABAP P
CVE-2026-109795	9.9 CRITICAL	Missing authorization check in S4CRM
CVE-2026-109803	9.9 CRITICAL	Code Injection vulnerability in SAP NetWeaver Knowledge Management (XML Forms)
CVE-2026-89119	9.6 CRITICAL	Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communi
CVE-2026-109798	9.1 CRITICAL	XML External Entity (XXE) Vulnerability in SAP BusinessObjects Business Intelligence Platf
CVE-2026-76966	8.9 HIGH	Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform
CVE-2026-120008	8.2 HIGH	Memory Corruption Vulnerability in SAP NetWeaver (Internet Graphics Service)
CVE-2026-109800	7.7 HIGH	Memory Corruption vulnerability in SAP Web Dispatcher
CVE-2026-120014	7.6 HIGH	Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communi
CVE-2026-109793	7.5 HIGH	Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server ABAP (Internet C
CVE-2026-109794	7.5 HIGH	Denial of Service vulnerability in SAP NetWeaver Application Server ABAP, ABAP Platform an
CVE-2026-109804	7.5 HIGH	Information Disclosure in SAP NetWeaver (SAP Message Server)
CVE-2026-109806	7.5 HIGH	Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service)
CVE-2026-109807	7.5 HIGH	Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service)
CVE-2026-89114	7.5 HIGH	Missing Authentication check in SAP NetWeaver AS Java EDM Application
CVE-2026-76973	7.5 HIGH	Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platf

Showing top 20 of 40 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same vendor: SAP_SE

Same weakness: CWE-347