SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
SAP's Python Cloud SDK can leak OAuth2 client secrets through tenant-subdomain SSRF, tracked as CVSS 10.0 CVE-2026-89111.
SAP disclosed CVE-2026-89111, a CVSS 10.0 server-side request forgery in the Cloud SDK for Python used by multi-tenant applications on Business Technology Platform. If an attacker controls the tenant subdomain passed to the SDK, the library can send the application's OAuth2 client ID and secret to an attacker-controlled token endpoint. SAP named version 0.45.2, released August 21, as the fix, but The Hacker News found versions 0.53.0 through 0.55.0 omitted the subdomain check for some Destination calls until 0.55.1. The advisory reports no attacks and says applications that cannot upgrade can validate tenant names against registered tenants first.