GHSA-93c9-96j8-4vg9: Cross-tenant sandbox takeover in SAP/astonish
In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenant container operations such as listing, exposing or proxying, and deleting containers.The issue affects only the legacy Incus backend. Kubernetes and OpenShell deployments are not affected because the relevant Incus-specific handlers are unavailable there.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only deployments using the legacy Incus backend are affected. Kubernetes and OpenShell deployments are not affected because the vulnerable Incus-specific handlers are unavailable there.
What access does an attacker need?
An attacker needs to be an authenticated user. The issue stems from legacy API handlers that did not use tenant-aware session lookup, enabling operations against another team's sandbox containers.
What actions could an attacker perform against another tenant's containers?
Affected handlers could allow cross-tenant container listing, exposing or proxying containers, and deleting containers.