CVE-2026-109797
Received Received - Intake

Improper Tenant Isolation in SAP Astonish Legacy Incus Sandbox

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: SAP SE

Description
In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenant container operations such as listing, exposing or proxying, and deleting containers.The issue affects only the legacy Incus backend. Kubernetes and OpenShell deployments are not affected because the relevant Incus-specific handlers are unavailable there.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-109797
EUVD
EUVD-2026-120705

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sap astonish From 3.6.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1220 The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109797 is a cross-tenant sandbox takeover vulnerability in SAP/astonish. It allows an authenticated user to access and manipulate another team's sandbox containers due to improper tenant isolation in the legacy Incus sandbox-management API handlers. The issue stems from these handlers not using tenant-aware session lookup, enabling unauthorized operations like listing, exposing, proxying, or deleting containers across tenants.

Detection Guidance

To detect this vulnerability, check for unauthorized container operations across tenants in the legacy Incus backend. Review logs for suspicious API calls to legacy Incus handlers, such as listing, exposing, proxying, or deleting containers. Ensure tenant-aware session mechanisms like buildPGSessionRegistry() are properly implemented.

Impact Analysis

This vulnerability could allow an attacker with authenticated access to perform unauthorized actions on other teams' sandbox containers. This includes listing, exposing, proxying, or deleting containers, potentially leading to data leakage, service disruption, or unauthorized access to sensitive information within those sandboxes.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA. GDPR mandates strict data access controls and breach notifications, while HIPAA requires safeguards for protected health information. A breach could result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade to SAP/astonish version v3.6.0 or later to apply the fix. Ensure affected handlers use tenant-aware session lookup mechanisms like buildPGSessionRegistry(). If using Kubernetes or OpenShell, no action is needed as they are unaffected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109797. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...