Critical SAP Cloud SDK SSRF Could Expose OAuth2 Client Credentials
Summary
CVE-2026-89111 lets attacker-controlled tenant subdomains redirect SAP Cloud SDK OAuth2 requests, potentially exposing client credentials. SAP patched the flaw; independently reported validation gaps affect versions 0.53.0–0.55.0. No confirmed exploitation was reported.
Key points
- The SSRF flaw (CVSS 10.0) affects SAP Cloud SDK for Python OAuth2 token requests and may expose client IDs and secrets.
- Exploitation requires influencing the tenant subdomain used by a multi-tenant application; stolen credentials could grant access within the client’s assigned roles and scopes.
- SAP lists version 0.45.2 as patched. Independent testing reported validation gaps in versions 0.53.0–0.55.0, with validation restored in 0.55.1.
- Affected flows include Agent Gateway, Destination, and Document Management Service modules.
- No confirmed exploitation was reported as of October 14, 2026.
- Upgrade to a validated fixed release; if delayed, allowlist tenant names, monitor outbound token requests and related telemetry, and rotate potentially exposed secrets.
Article Details
- Vulnerability Types
- Server-side request forgery (SSRF)
- Severity
- Critical; CVSS 10.0
- Affected Versions
- SAP Cloud SDK for Python versions below 0.45.2
- SAP Cloud SDK for Python versions 0.53.0 through 0.55.0 (independently reported validation gap in some paths)
- Exploitation Status
- not_reported
- Exploit Availability
- none_reported
- Patch Status
- available
- Workarounds
- Validate tenant_subdomain against an allowlist of registered tenant names before passing it to an SDK call.