SAP/ASTONISH · CVE-2026-109797 · AI agents & MCP
FIX → v3.6.0 ✓ verified
Astonish, an SAP project that runs AI agent sandboxes, has a tenant isolation flaw in its legacy Incus sandbox API handlers. A logged-in user can list, expose, proxy and delete containers that belong to another team.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only deployments of Astonish that use the legacy Incus sandbox backend are affected, per the description. Kubernetes and OpenShell deployments are stated as not affected because the Incus-specific handlers are unavailable there. Exposure requires an authenticated account on the Astonish service.
Not affected if kubernetes-backend, openshell-backend
Who cares astonish, incus, sandboxes, self-hosted
Upgrade to v3.6.0
In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenant container operations such as listing, exposing or proxying, and deleting containers.The issue affects only the legacy Incus backend. Kubernetes and OpenShell deployments are not affected because the relevant Incus-specific handlers are unavailable there.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade SAP/astonish to v3.6.0 (handlers now routed through buildPGSessionRegistry() / tenant check)