CVE-2026-109799: Improper verification of JWT signature in IASContextProvider leads to tenant/user identity spoofing ( sap-cloud-sdk (pip))
The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in IASContextProvider, the runtime-context provider registered by default via bootstrap(app).IASContextProvider extracted the apptid, sapgtid and useruuid claims from the IAS JWT in the Authorization header using an unverified decoder and wrote them into the request-scoped RuntimeContext without validating the token signature. A remote caller could submit a self-signed JWT naming a victim tenant/user; the forged identity then propagated to every consumer of the runtime context:OTel span attributes (sap.tenancy.tenantid, user.id) via RuntimeContextSpanProcessorlog records via IdentityLogFilteraudit events (tenantid, userinitiatorid) via AuditClienttenant routing via CBCClientThis completes an earlier remediation that fixed the same unverified pattern in StarletteIASTelemetryMiddleware but did not cover IASContextProvider.
Affected Software
Event History
Frequently Asked Questions
Are applications using the standard SDK bootstrap exposed?
Yes. IASContextProvider is registered by default through bootstrap(app), so applications using that default runtime-context setup are affected.
What does an attacker need to exploit this issue?
A remote caller can submit a self-signed IAS JWT in the Authorization header that names a chosen tenant and user. No privileges or user interaction are indicated by the supplied severity vector.
What can be affected after a forged identity is accepted?
The forged tenant and user identity can propagate to OpenTelemetry span attributes, log records, audit events, and tenant routing through CBCClient. This can cause identity spoofing in telemetry, auditing, logging, and routing consumers of the runtime context.
Is the earlier StarletteIASTelemetryMiddleware remediation sufficient?
No. The earlier remediation addressed the unverified JWT pattern in StarletteIASTelemetryMiddleware but did not cover IASContextProvider.