Is CVE-2026-109799 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109799 being exploited in the wild.

How severe is CVE-2026-109799?

High severity, with a CVSS score of 7.5, published 10 November 2026.

Which products and versions are affected?

SAP Cloud SDK for Python < 0.63.1.

Is there a fix for CVE-2026-109799?

Yes: fixed in 0.63.1. Until then: Enforce JWT signature verification at the ingress/API gateway before requests reach the SDK, or supply an explicit verified TokenVerifier to the IASContextProvider. [ { "kind": "disclosed", "at": "2026-11-10" }, { "kind": "patched", "at": "2026-11-10", "note": "Version 0.63.1 released with signature verification fix" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109799 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-109799?

Check whether you run SAP Cloud SDK for Python at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109799: SAP Cloud SDK for Python improper JWT signature verification in IASContextProvider

Q: Is there a fix for CVE-2026-109799?

Yes: fixed in 0.63.1. Until then: Enforce JWT signature verification at the ingress/API gateway before requests reach the SDK, or supply an explicit verified TokenVerifier to the IASContextProvider. [ { "kind": "disclosed", "at": "2026-11-10" }, { "kind": "patched", "at": "2026-11-10", "note": "Version 0.63.1 released with signature verification fix" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-109799 · Severity: high · CVSS 7.5 · Published 2026-11-10

The SAP Cloud SDK for Python, a framework used by developers to build cloud applications, fails to properly verify the authenticity of JSON Web Tokens (JWTs) used for user identity. An attacker can forge a JWT to impersonate any tenant or user, causing the application to trust the forged identity for logging, auditing, and tenant routing. This allows unauthorized access, falsified audit trails, and potential lateral movement across multi-tenant systems.

Technologies: SAP Cloud SDK for Python. Vendors: SAP.

Quick answers

Is CVE-2026-109799 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109799 being exploited in the wild.
How severe is CVE-2026-109799?: High severity, with a CVSS score of 7.5, published 10 November 2026.
Which products and versions are affected?: SAP Cloud SDK for Python < 0.63.1.
Is there a fix for CVE-2026-109799?: Yes: fixed in 0.63.1. Until then: Enforce JWT signature verification at the ingress/API gateway before requests reach the SDK, or supply an explicit verified TokenVerifier to the IASContextProvider.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-11-10" }, { "kind": "patched", "at": "2026-11-10", "note": "Version 0.63.1 released with signature verification fix" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109799 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-109799?: Check whether you run SAP Cloud SDK for Python at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.63.1

Enforce JWT signature verification at the ingress/API gateway before requests reach the SDK, or supply an explicit verified TokenVerifier to the IASContextProvider.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-11-10" }, { "kind": "patched", "at": "2026-11-10", "note": "Version 0.63.1 released with signature verification fix" } ]

Technical details

The IASContextProvider component extracts tenant and user identity claims from JWTs in the Authorization header without verifying the signature, accepting self-signed or unsigned tokens. An unauthenticated remote attacker can submit a crafted JWT to spoof identity, which then propagates to OTel span attributes, log records, audit events, and tenant routing logic. The vulnerability was patched in version 0.63.1 by adding JWKS-backed JWT signature verification via IASVerifier, failing closed if verification fails.

Affected products

SAP Cloud SDK for Python < 0.63.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.