SAP Python Cloud SDK SSRF Can Leak OAuth2 Secrets
CVE-2026-89111, a CVSS 10 SSRF in SAP Cloud SDK for Python, can send OAuth2 client secrets to an attacker-controlled endpoint.
SAP disclosed CVE-2026-89111, also tracked as GHSA-4mv3-jxxm-9cx2, a maximum-severity CWE-918 server-side request forgery in the Cloud SDK for Python used by multi-tenant applications on Business Technology Platform. Insufficient validation of a tenant subdomain used to build an OAuth2 token URL can let an attacker-controlled value cause the application to send its OAuth2 client ID and client secret to an unintended server. SAP named version 0.45.2, released August 21, as the fix, but The Hacker News found that versions 0.53.0 through 0.55.0 omitted the subdomain check for some Destination calls until 0.55.1. SOCRadar does not discuss those later versions. SAP reports no attacks, and SOCRadar's excerpt does not say exploitation has been observed. Applications that cannot upgrade can validate tenant names against registered tenants first.
- CVE-2026-89111 (also GHSA-4mv3-jxxm-9cx2) is a CVSS 10.0 CWE-918 server-side request forgery in SAP Cloud SDK for Python.
- If an attacker controls the tenant subdomain used to build an OAuth2 token URL, the SDK can send the application's OAuth2 client ID and secret to an unintended token endpoint.
- The issue affects multi-tenant applications on SAP Business Technology Platform.
- SAP named version 0.45.2, released August 21, as the fix.
- The Hacker News reported that versions 0.53.0 through 0.55.0 omitted the subdomain check for some Destination calls until 0.55.1.
- SAP reports no attacks; SOCRadar's excerpt does not say exploitation has been observed.
- Applications that cannot upgrade can validate tenant names against registered tenants first.
Coverage timelineoldest first · each row is one article
- · 3d agoSAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
The Hacker News· 64
SAP's Python Cloud SDK can leak OAuth2 client secrets through tenant-subdomain SSRF, tracked as CVSS 10.0 CVE-2026-89111.
- · 2d agoCVE-2026-89111: Critical SAP Cloud SDK SSRF
SOCRadar· 76
SAP disclosed CVE-2026-89111, a CVSS 10 SSRF in SAP Cloud SDK for Python that can leak OAuth2 secrets.
Vulnerabilities in this storyAll →
- CVE-2026-8911110.0—OAuth2 SSRF credential theft in SAP Cloud SDK for Pythonpublished · SAP Cloud SDK for Python
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-89111 | OAuth2 SSRF credential theft in SAP Cloud SDK for Python SAP Cloud SDK for Python has a critical OAuth2 server-side request forgery flaw (CWE-918) in multi-tenant SAP BTP applications. An unauthenticated remote attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server. That redirection can exfiltrate client credentials and, given the changed scope and high confidentiality and integrity impact, compromise trust beyond the vulnerable component. Applications built with the SDK that accept an attacker-influenced tenant subdomain in the OAuth2 flow are affected; exact versions are not stated in the advisory data. It is not listed in CISA KEV, and no public proof of concept is known. Apply the SAP security note or upgrade SAP Cloud SDK for Python as soon as a fixed release is published; do not pass untrusted input as tenant_subdomain. Restrict outbound OAuth2 token requests to known SAP identity endpoints and rotate client credentials if that parameter may have been attacker-controlled. |