cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

SAP Cloud SDK for Python Flaw Could Expose OAuth2 Credentials

· Original article ↗

Summary

SAP disclosed a CVSS 10.0 SSRF flaw in its Cloud SDK for Python that could send OAuth2 client credentials to an attacker-controlled server. SAP fixed it, but later releases reportedly omitted the check; the advisory does not clarify their CVE status.

Key points

  • CVE-2026-89111 affects multi-tenant SAP BTP applications that pass a tenant subdomain to the Cloud SDK for Python.
  • An attacker able to control the tenant subdomain could redirect a token request and capture the application's client ID and secret.
  • The flaw received SAP's maximum CVSS score of 10.0; the article reports no attacks.
  • SAP's advisory names version 0.45.2 as the fix, but the article's tests found the check missing in versions 0.53.0–0.55.0 and in 0.36.1 and 0.36.2.
  • Version 0.55.1 restored the check in the Destination module; tested versions 0.45.2–0.52.2 and 0.55.1–0.58.4 passed SAP's 11 tests.
  • SAP's advisory does not list versions above 0.45.2 as affected or clarify whether the later releases missing the check fall under the CVE.
  • SAP advises applications unable to upgrade to validate tenant subdomains against their registered tenants before passing them to the SDK.

Article Details

Vulnerability Types
  • Server-side request forgery (SSRF)
Severity
Critical; CVSS 10.0 out of 10 (SAP)
Affected Versions
  • Versions below 0.45.2, according to the advisory
  • 0.53.0 through 0.55.0, when using the Destination service module, failed the reported security-check tests; whether these releases fall under CVE-2026-89111 is not stated
  • 0.36.1 and 0.36.2 lack the check and fall within the advisory's range of versions below 0.45.2
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Compare each tenant subdomain against a list of registered tenants before passing it to the SDK.

CVE

CVE-2026-89111The flaw is tracked as CVE-2026-89111 and carries SAP's CVSS score of 10.0 out of 10. The advisory names version 0.45.2, released on August 21, as the fix.

Vendors

SAPA flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP

Products

SAP Business Technology Platform (BTP)said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP's official Python client for BTP services. An attacker must be ableSAP Cloud SDK for PythonA flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP

Related Articles