SAP disclosed CVE-2026-89111, a CVSS 10 SSRF in SAP Cloud SDK for Python that can leak OAuth2 secrets.
SAP disclosed CVE-2026-89111, also tracked as GHSA-4mv3-jxxm-9cx2, a maximum-severity CWE-918 server-side request forgery in SAP Cloud SDK for Python. The flaw affects OAuth2 token requests that build a tenant-specific token URL from a tenant subdomain. Insufficient validation can let an attacker-controlled value redirect the request so the application sends its OAuth2 client ID and client secret to an unintended server. The excerpt does not say exploitation has been observed.
CVE-2026-89111 scores CVSS 10.0 and is classified as CWE-918 SSRF.
Also tracked as GHSA-4mv3-jxxm-9cx2.
Affects OAuth2 token URL construction in SAP Cloud SDK for Python.
An attacker-controlled tenant value can redirect client ID and secret.
OAuth2 SSRF credential theft in SAP Cloud SDK for Python
SAP Cloud SDK for Python has a critical OAuth2 server-side request forgery flaw (CWE-918) in multi-tenant SAP BTP applications. An unauthenticated remote attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server. That redirection can exfiltrate client credentials and, given the changed scope and high confidentiality and integrity impact, compromise trust beyond the vulnerable component. Applications built with the SDK that accept an attacker-influenced tenant subdomain in the OAuth2 flow are affected; exact versions are not stated in the advisory data. It is not listed in CISA KEV, and no public proof of concept is known.
Apply the SAP security note or upgrade SAP Cloud SDK for Python as soon as a fixed release is published; do not pass untrusted input as tenant_subdomain. Restrict outbound OAuth2 token requests to known SAP identity endpoints and rotate client credentials if that parameter may have been attacker-controlled.
Full article2,454 words · extracted from socradar.io · click to collapse
SAP has disclosed CVE-2026-89111, a maximum-severity server-side request forgery (SSRF) vulnerability in SAP Cloud SDK for Python that can expose OAuth2 client credentials.
What Is CVE-2026-89111?
CVE-2026-89111 (CVSS 10.0), also tracked as GHSA-4mv3-jxxm-9cx2, is a CWE-918 SSRF vulnerability affecting OAuth2 token requests.
The SDK builds a tenant-specific token URL using tenant_subdomain. In vulnerable versions, insufficient validation can allow an attacker-controlled value to redirect the request to another server, causing the application to send its OAuth2 client ID and client secret to an unintended destination.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
This indicates network reachability, low complexity, no required privileges or user interaction, and potentially high confidentiality and integrity impact.
SAP fixed the issue by validating tenant_subdomain against RFC 1123-style DNS label rules before inserting it into token URLs.
Which SAP Cloud SDK Versions Are Affected?
SAP’s formal advisory identifies:
Version
Status
Below 0.45.2
Affected
0.45.2
Officially patched
However, independent testing by The Hacker News found an important later-version gap. Versions 0.53.0 through 0.55.0 did not consistently apply the validation in some Destination-service paths; version 0.55.0 also showed the issue in Document Management Service handling. Validation was restored in shared token-requesting code in 0.55.1.
Testing reported the validation present in 0.45.2–0.52.2 and 0.55.1–0.58.4. SAP’s advisory currently does not state whether the 0.53.0–0.55.0 behavior is formally covered by CVE-2026-89111.
Organizations running those intermediate releases should therefore review their module usage and consider moving to 0.55.1 or later, where compatible.
How Could CVE-2026-89111 Be Exploited?
An attacker must be able to influence the tenant subdomain supplied by a multi-tenant application.
If the affected SDK path accepts the malicious value, the OAuth2 token request can be redirected to an attacker-controlled server, potentially exposing reusable application credentials.
The practical impact depends on the OAuth2 client’s roles and scopes. Stolen credentials could provide access to BTP services available to that client, but the vulnerability does not automatically provide administrative access or remote code execution.
The affected flows include the Agent Gateway, Destination, and Document Management Service modules.
Is CVE-2026-89111 Being Exploited?
No confirmed exploitation has been reported as of October 14, 2026.
SAP’s advisory does not report attacks, and the current review found no confirmed CISA KEV listing or reliable public exploit.
The absence of active exploitation does not reduce the need to patch: exposed OAuth2 credentials can remain useful beyond the original request if their scopes permit access to sensitive services.
Other SAP October 2026 Security Patch Day Highlights
SAP’s October 2026 Security Patch Day included 16 new security notes, four GitHub security advisories, and two updates to previous notes. SAP recommends applying the patches on priority.
Other notable vulnerabilities include:
CVE-2026-89110 (CVSS 9.9): Broken access control in SAP NetWeaver Visual Composer.
CVE-2026-89107 (CVSS 9.9): Code injection in SAP S/4HANA Manage Substitution/Validation Rules.
CVE-2026-89108 (CVSS 9.1): Missing authorization check in SAP Manufacturing Integration and Intelligence.
CVE-2026-89113 (CVSS 8.8): SQL injection in SAP Commerce Cloud.
These should be reviewed alongside CVE-2026-89111 based on which SAP products are present in the environment.
Track CVE-2026-89111 with SOCRadar
SOCRadar’s Cyber Threat Intelligence module provides timely visibility into actively exploited vulnerabilities by aggregating CVE disclosures, exploitation evidence, threat actor activity, and CISA KEV updates in one place. This enables security teams to quickly understand whether a vulnerability like CVE-2026-89111 is being abused in real-world attacks and how it is being leveraged.
In addition, SOCRadar’s Attack Surface Management (ASM) module continuously maps internet-facing assets and identifies exposed services and devices. By linking threat intelligence with asset visibility, teams can determine whether affected products are reachable and prioritize remediation efforts based on actual exposure.
SOCRadar’s Vulnerability Intelligence
What Should Defenders Do?
Upgrade affected sap-cloud-sdk deployments to a validated fixed release. SAP officially lists 0.45.2 as the patch, while environments running 0.53.0–0.55.0 should review the independently reported validation gap.
If upgrading is delayed, SAP recommends validating tenant_subdomain against an allowlist of registered tenant names before passing it to any SDK call.
Defenders should also review outbound OAuth2 token requests for unexpected destinations, inspect proxy and DNS telemetry, and check BTP audit logs for unusual use of affected client identities.
Where suspicious redirection is identified, determine whether client credentials may have been exposed and consider rotating secrets and reviewing the permissions assigned to those clients.
PROTECTION OF PERSONAL DATA****COOKIE POLICY FOR THE INTERNET SITE
Protecting your personal data is one of the core principles of our organization, SOCRadar, which operates the internet site (www.socradar.com). This Cookie Usage Policy (“Policy”) explains the types of cookies used and the conditions under which they are used to all website visitors and users.
Cookies are small text files stored on your computer or mobile device by the websites you visit.
Cookies are commonly used to provide you with a personalized experience while using a website, enhance the services offered, and improve your overall browsing experience, contributing to ease of use while navigating a website. If you prefer not to use cookies, you can delete or block them through your browser settings. However, please be aware that this may affect your usage of our website. Unless you change your cookie settings in your browser, we will assume that you accept the use of cookies on this site.
1. WHAT KIND OF DATA IS PROCESSED IN COOKIES?
Cookies on websites collect data related to your browsing and usage preferences on the device you use to visit the site, depending on their type. This data includes information about the pages you access, the services and products you explore, your preferred language choice, and other preferences.
2. WHAT ARE COOKIES AND WHAT ARE THEIR PURPOSES?
Cookies are small text files stored on your device or web server by the websites you visit through your browsers. These small text files, containing your preferred language and other settings, help us remember your preferences on your next visit and assist us in making improvements to our services to enhance your experience on the site. This way, you can have a better and more personalized user experience on your next visit.
The main purposes of using cookies on our Internet Site are as follows:
Improve the functionality and performance of the website to enhance the services provided to you,
Enhance and introduce new features to the Internet Site and customize the provided features based on your preferences,
Ensure legal and commercial security for the Internet Site, yourself, and the Organization, and prevent fraudulent transactions through the Site,
Fulfill legal and contractual obligations, including those arising from Law No. 5651 on the Regulation of Publications on the Internet and the Fight Against Crimes Committed Through These Publications, as well as the Regulation on the Procedures and Principles Regarding the Regulation of Publications on the Internet.
3. TYPES OF COOKIES USED ON OUR INTERNET SITE****3.1. Session Cookies
Session cookies ensure the smooth operation of the internet site during your visit. They are used for purposes such as ensuring the security and continuity of our sites and your visits. Session cookies are temporary cookies and are deleted when you close your browser; they are not permanent.
3.2. Persistent Cookies
These cookies are used to remember your preferences and are stored on your device through browsers. Persistent cookies remain stored on your device even after you close your browser or restart your computer. These cookies are stored in your browser’s subfolders until deleted from your browser’s settings. Some types of persistent cookies can be used to provide personalized recommendations based on your usage purposes.
With persistent cookies, when you revisit our website with the same device, the website checks if a cookie created by our website exists on your device. If so, it is understood that you have visited the site before, and the content to be presented to you is determined accordingly, offering you a better service.
3.3. Mandatory/Technical Cookies
Mandatory cookies are essential for the proper functioning of the visited internet site. The purpose of these cookies is to provide necessary services by ensuring the operation of the site. For example, they allow access to secure sections of the internet site, use of its features, and navigation.
3.4. Analytical Cookies
These cookies gather information about how the website is used, the frequency and number of visits, and show how visitors navigate to the site. The purpose of using these cookies is to improve the operation of the site, increase its performance, and determine general trend directions. They do not contain data that can identify visitors. For example, they show the number of error messages displayed or the most visited pages.
3.5. Functional Cookies
Functional cookies remember the choices made by visitors within the site and recall them during the next visit. The purpose of these cookies is to provide ease of use to visitors. For example, they prevent the need to re-enter the user’s password on each page visited by the site user.
3.6. Targeting/Advertising Cookies
They measure the effectiveness of advertisements shown to visitors and calculate how many times ads are displayed. The purpose of these cookies is to present personalized advertisements to visitors based on their interests.
Similarly, they determine the specific interests of visitors’ navigation and present appropriate content. For example, they prevent the same advertisement from being shown again to the visitor in a short period.
4. HOW TO MANAGE COOKIE PREFERENCES?
To change your preferences regarding the use of cookies, block or delete cookies, you only need to change your browser settings.
Many browsers offer options to accept or reject cookies, only accept certain types of cookies, or receive notifications from the browser when a website requests to store cookies on your device.
Also, it is possible to delete previously saved cookies from your browser.
If you disable or reject cookies, you may need to manually adjust some preferences, and certain features and services on the website may not work properly as we will not be able to recognize and associate with your account. You can change your browser settings by clicking on the relevant link from the table below.
5. EFFECTIVE DATE OF THE INTERNET SITE PRIVACY POLICY
The Internet Site Privacy Policy is dated The effective date of the Policy will be updated if the entire Policy or specific sections are renewed. The Privacy Policy is published on the Organization’s website (www.socradar.com) and made accessible to relevant individuals upon request.
SOCRadar
Address: 651 N Broad St, Suite 205 Middletown, DE 19709 USA
Phone: +1 (571) 249-4598
Email: [email protected]
Website: www.socradar.com
Extended Threat Intelligence Threat intelligence enriched with External Attack Surface Management, Brand Protection, and Dark Web Radar. Explore XTIAgentic Threat Intelligence Stay ahead of cybercriminals with AI agents that autonomously think, adapt, and act. Explore ATI Advanced Dark Web Monitoring
Dark Web Report
