SAP Cloud SDK for Python (Product): news timeline & CVEs

CVE-2026-89111: Critical SAP Cloud SDK SSRF

SAP disclosed CVE-2026-89111, a CVSS 10 SSRF in SAP Cloud SDK for Python that can leak OAuth2 secrets.

SAP disclosed CVE-2026-89111, also tracked as GHSA-4mv3-jxxm-9cx2, a maximum-severity CWE-918 server-side request forgery in SAP Cloud SDK for Python. The flaw affects OAuth2 token requests that build a tenant-specific token URL from a tenant subdomain. Insufficient validation can let an attacker-controlled value redirect the request so the application sends its OAuth2 client ID and client secret to an unintended server. The excerpt does not say exploitation has been observed.

SOCRadarOct 14, 14:03 UTC · 2d agoVulnerability 2 sources CVE-2026-891112· 1 read

SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft

SAP's Python Cloud SDK can leak OAuth2 client secrets through tenant-subdomain SSRF, tracked as CVSS 10.0 CVE-2026-89111.

SAP disclosed CVE-2026-89111, a CVSS 10.0 server-side request forgery in the Cloud SDK for Python used by multi-tenant applications on Business Technology Platform. If an attacker controls the tenant subdomain passed to the SDK, the library can send the application's OAuth2 client ID and secret to an attacker-controlled token endpoint. SAP named version 0.45.2, released August 21, as the fix, but The Hacker News found versions 0.53.0 through 0.55.0 omitted the subdomain check for some Destination calls until 0.55.1. The advisory reports no attacks and says applications that cannot upgrade can validate tenant names against registered tenants first.

The Hacker Newsupdated Oct 14, 14:03 UTC · 2d agofirst Oct 13, 17:28 UTC · 3d agoVulnerability 2 sources CVE-2026-891112· 1 read

SAP Cloud SDK for Python

Timeline2 articles

Related CVEsby mentions

Appears with

CVE-2026-89111: Critical SAP Cloud SDK SSRF

SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft