CVE-2026-89111

CVE Enrichment

CVSS: 10.0 CRITICAL
EPSS: 0.27%
EPSS Percentile: 18.39%
CISA KEV: Not listed

Description

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: cna@sap.com
Published: 13-Oct-2026 08:16
Last Modified: 13-Oct-2026 10:16
EPSS Date: 2026-10-13
CWE: CWE-918

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:N

References

Last enrichment sync: 13-Oct-2026 23:09
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (4)

CVE-2026-89111: Critical SAP Cloud SDK SSRF Critical SAP Cloud SDK SSRF Could Expose OAuth2 Client Credentials
At the top of the list is CVE-2026-89111 (CVSS score of 10/10), an OAuth2 SSRF vulnerability in Cloud SDK for Python that impacts multi-tenant BTP applications. SAP Patches Critical NetWeaver, S/4HANA and Other Vulnerabilities
The flaw is tracked as CVE-2026-89111 and carries SAP's CVSS score of 10.0 out of 10. The advisory names version 0.45.2, released on August 21, as the fix. SAP Cloud SDK for Python Flaw Could Expose OAuth2 Credentials
Tracked as CVE-2026-89111, the maximum-severity vulnerability patched this month can be exploited by remote attackers without privileges to steal credentials. SAP Patches Maximum-Severity OAuth2 SSRF Flaw in Python SDK

CVE (5)

People (2)

Vendors (1)

Products (10)

Industries (1)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.