SAP-CLOUD-SDK · CVE-2026-109799 · Package
FIX → 0.63.1 ✓ verified
SAP Cloud SDK for Python (sap-cloud-sdk < 0.63.1) trusted tenant, tenant-group and user claims from the IAS JWT without checking its signature. A remote caller could send a self-signed token naming a victim tenant and user, and that forged identity flowed into telemetry, logs, audit events and tenant routing. Fixed in 0.63.1.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Python services using sap-cloud-sdk (pip) older than 0.63.1 that call bootstrap(app), which registers IASContextProvider by default, and receive IAS JWTs in the Authorization header. An unauthenticated remote caller can forge tenant and user identity, which then flows into traces, logs, audit events and tenant routing. Services that verify the JWT signature at ingress before the SDK sees the request, or that don't use the runtime-context provider, can skip it.
Not affected if no-ias-jwt, upstream-token-validation
Who cares ias, multi-tenant, pip, python, sap-cloud-sdk
pip show sap-cloud-sdk (or pip list)0.63.1 are affected if the app calls bootstrap(app), which registers IASContextProvider by default, and accepts IAS JWTs in the Authorization headerThe SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in IASContextProvider, the runtime-context provider registered by default via bootstrap(app).IASContextProvider extracted the app_tid, sap_gtid and user_uuid claims from the IAS JWT in the Authorization header using an unverified decoder and wrote them into the request-scoped RuntimeContext without validating the token signature. A remote caller could submit a self-signed JWT naming a victim tenant/user; the forged identity then propagated to every consumer of the runtime context:OTel span attributes (sap.tenancy.tenant_id, user.id) via RuntimeContextSpanProcessorlog records via IdentityLogFilteraudit events (tenant_id, user_initiator_id) via AuditClienttenant routing via CBCClientThis completes an earlier remediation that fixed the same unverified pattern in StarletteIASTelemetryMiddleware but did not cover IASContextProvider.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 0.63.1
Upgrade sap-cloud-sdk (pip) to 0.63.1 or later. 0.63.1 verifies the IAS JWT signature via JWKS-backed IASVerifier and returns an empty context if verification fails or no IAS binding exists.