SAP Patches Maximum-Severity OAuth2 SSRF Flaw in Python SDK
Summary
SAP patched a maximum-severity OAuth2 SSRF flaw in its Python SDK that could let remote attackers steal credentials from multi-tenant BTP applications. An allowlist for tenant_subdomain is a temporary mitigation.
Key points
- CVE-2026-89111 affects the SAP Cloud SDK for Python and can be exploited remotely without privileges.
- An attacker controlling tenant_subdomain can redirect OAuth2 token requests to an attacker-controlled server and exfiltrate client credentials.
- SAP recommends validating tenant_subdomain against an allowlist of registered tenant subdomains if patches cannot be deployed immediately.
- SAP’s October 2026 updates address 20 security flaws across multiple products.
- The updates also fix a critical broken access control flaw in NetWeaver Visual Composer and a critical flaw in SAP Manufacturing Integration and Intelligence.
Article Details
- Vulnerability Types
- Server-side request forgery (SSRF)
- Broken access control
- Memory corruption
- Severity
- Maximum severity for CVE-2026-89111; critical for CVE-2026-89110 and CVE-2026-89108. No severity stated for CVE-2026-58231 or CVE-2026-44756.
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For CVE-2026-89111, validate tenant_subdomain against an allowlist of registered tenant subdomains before passing it to any SDK call.
CVE
CVE-2026-44756More recently, in September, it also fixed the CVE-2026-44756 memory corruption flaw in the SAP Kernel code, dubbed OVERPASS by Onapsis security researchers who reported it.CVE-2026-58231For instance, it patched CVE-2026-58231 in the Commerce Cloud cloud-based e-commerce platform in August, which threat intelligence firm Defused flagged as actively exploited in attacks days after it was addressed.CVE-2026-89108Another critical flaw patched today in SAP Manufacturing Integration and Intelligence (tracked as CVE-2026-89108) lets threat actors with administrator privileges gain admin control over the underlying system byCVE-2026-89110Today, SAP also addressed CVE-2026-89110, a critical broken access control vulnerability in the SAP NetWeaver Visual Composer that could let remote attackers with limited privileges fully compromise vulnerable systems.CVE-2026-89111Tracked as CVE-2026-89111, the maximum-severity vulnerability patched this month can be exploited by remote attackers without privileges to steal credentials.
People
Vendors
Products
Commerce CloudFor instance, it patched CVE-2026-58231 in the Commerce Cloud cloud-based e-commerce platform in August, which threat intelligence firm Defused flagged as actively exploited in attacks days after it was addressed.SAP Business Technology Platform (BTP)The SAP Python SDK is the official programmatic toolkit for developing AI agents and Python applications on the company's SAP Business Technology Platform (BTP) services.SAP Cloud SDK for Python"The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications.SAP KernelMore recently, in September, it also fixed the CVE-2026-44756 memory corruption flaw in the SAP Kernel code, dubbed OVERPASS by Onapsis security researchers who reported it.SAP Manufacturing Integration and IntelligenceAnother critical flaw patched today in SAP Manufacturing Integration and Intelligence (tracked as CVE-2026-89108) lets threat actors with administrator privileges gain admin control over the underlying system bySAP NetWeaver Visual ComposerToday, SAP also addressed CVE-2026-89110, a critical broken access control vulnerability in the SAP NetWeaver Visual Composer that could let remote attackers with limited privileges fully compromise vulnerable systems.