Improper Tenant Isolation in SAP Astonish Legacy Framework

CVE-2026-109797

What is CVE-2026-109797?

In SAP Astonish, an issue arises due to insufficient tenant isolation within the legacy Incus sandbox-management API handlers. This vulnerability can allow authenticated users to manage and manipulate sandbox containers belonging to other teams. Without the proper tenant-aware session lookup path, affected handlers expose the system to risks such as unauthorized listing, accessing, or deleting of sandbox containers. It is important to note that this vulnerability is specific to the legacy Incus backend, and deployments utilizing Kubernetes or OpenShell remain unaffected due to the absence of these specific handlers.

References