CVE-2026-109797
Cross-tenant sandbox takeover in SAP/astonish
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenant container operations such as listing, exposing or proxying, and deleting containers.The issue affects only the legacy Incus backend. Kubernetes and OpenShell deployments are not affected because the relevant Incus-specific handlers are unavailable there.
| Vendor | sap_se |
| Product | sap/astonish |
| Published | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for sap_se sap/astonish
Be the first to know when new high vulnerabilities affecting sap_se sap/astonish are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Affected Versions
SAP_SE / SAP/astonish
<v3.6.0