# CVE-2026-109799: SAP Cloud SDK for Python improper JWT signature verification in IASContextProvider

Source: https://junglewise.ai/threats/cve-2026-109799-the-sap-cloud-sdk-for-python-contains-an-improper-cryptographic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-109799 · Severity: high · CVSS 7.5 · Published 2026-11-10

The SAP Cloud SDK for Python, a framework used by developers to build cloud applications, fails to properly verify the authenticity of JSON Web Tokens (JWTs) used for user identity. An attacker can forge a JWT to impersonate any tenant or user, causing the application to trust the forged identity for logging, auditing, and tenant routing. This allows unauthorized access, falsified audit trails, and potential lateral movement across multi-tenant systems.

Technologies: [SAP Cloud SDK for Python](https://junglewise.ai/threats/technologies/cloud-sdk-for-python). Vendors: [SAP](https://junglewise.ai/threats/vendors/sap).

## Quick answers

**Is CVE-2026-109799 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109799 being exploited in the wild.

**How severe is CVE-2026-109799?** High severity, with a CVSS score of 7.5, published 10 November 2026.

**Which products and versions are affected?** SAP Cloud SDK for Python < 0.63.1.

**Is there a fix for CVE-2026-109799?** Yes: fixed in 0.63.1. Until then: Enforce JWT signature verification at the ingress/API gateway before requests reach the SDK, or supply an explicit verified TokenVerifier to the IASContextProvider.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-11-10"
  },
  {
    "kind": "patched",
    "at": "2026-11-10",
    "note": "Version 0.63.1 released with signature verification fix"
  }
] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109799 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-109799?** Check whether you run SAP Cloud SDK for Python at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.63.1

Enforce JWT signature verification at the ingress/API gateway before requests reach the SDK, or supply an explicit verified TokenVerifier to the IASContextProvider.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-11-10"
  },
  {
    "kind": "patched",
    "at": "2026-11-10",
    "note": "Version 0.63.1 released with signature verification fix"
  }
]

## Technical details

The IASContextProvider component extracts tenant and user identity claims from JWTs in the Authorization header without verifying the signature, accepting self-signed or unsigned tokens. An unauthenticated remote attacker can submit a crafted JWT to spoof identity, which then propagates to OTel span attributes, log records, audit events, and tenant routing logic. The vulnerability was patched in version 0.63.1 by adding JWKS-backed JWT signature verification via IASVerifier, failing closed if verification fails.

## Affected products

- SAP Cloud SDK for Python < 0.63.1

## References

- [https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-93m8-crj2-v997](https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-93m8-crj2-v997)
- [https://url.sap/sapsecuritypatchday](https://url.sap/sapsecuritypatchday)

## Related threats

- [SAP Cloud SDK for Python path traversal in agent_memory module](https://junglewise.ai/threats/cve-2026-120013-the-agent-memory-module-accepts-a-caller-supplied-tenant)
- [SAP Cloud SDK for Python OAuth2 SSRF vulnerability](https://junglewise.ai/threats/cve-2026-89111-the-sap-cloud-sdk-for-python-contains-an-oauth2-ssrf)