SAP Python SDK <0.45.2 Fixes CVSS 10 SSRF That Leaks OAuth2 Credentials in Multi-Tenant BTP Apps
A critical SSRF flaw in the SAP Cloud SDK for Python allows attackers to steal OAuth2 client credentials from multi-tenant BTP applications.
Key points
- The vulnerability is rated CVSS 10 Critical by the NVD.
- It affects versions of the SAP Cloud SDK for Python prior to 0.45.2.
- Attackers can redirect token requests to exfiltrate client credentials.
The National Vulnerability Database lists CVE-2026-89111 as a critical security flaw in the SAP Cloud SDK for Python. The issue stems from an OAuth2 server-side request forgery vulnerability that impacts multi-tenant Business Technology Platform applications. According to the NVD record, this weakness allows attackers to manipulate how the SDK handles authentication requests.
The risk
An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to a server they control. This redirection causes the SDK to send client credentials to the attacker instead of the legitimate SAP service. The NVD assigns a CVSS score of 10 to this vulnerability, indicating the highest level of severity. The flaw is categorized under CWE-918.
Who is exposed
The vulnerability affects the SAP Cloud SDK for Python in versions older than 0.45.2. Organizations using multi-tenant applications on the SAP Business Technology Platform are specifically at risk. The NVD record identifies the affected product as sap-cloud-sdk from vendor SAP_SE. Any deployment using a version below the threshold is vulnerable to this credential exfiltration technique.
Cost and compliance
The NVD record does not specify financial costs or compliance penalties associated with this vulnerability. It provides only the technical description, CVSS score, and affected product versions. There is no mention of confirmed exploitation in the wild or specific regulatory impacts in the source material. The focus remains on the technical capability for credential theft.
What should you do?
Managers should immediately inventory their Python-based SAP Cloud SDK deployments. Verify the current version against the affected range. Plan to upgrade to version 0.45.2 or later as soon as it is available. Monitor for official vendor announcements regarding patches.
Background: Server-side request forgery (SSRF)
Server-side request forgery occurs when your application fetches a URL from an untrusted source without validating it. This lets attackers make your server request internal resources, private cloud data, or other machines, bypassing standard access controls and firewalls.
Read the full guide: Server-Side Request Forgery: How SSRF Bypasses Your Network Defenses
What to do and how to stay safe: SAP
- Audit all Python applications to identify usage of the SAP Cloud SDK.
- Check the installed version against the vulnerable range listed by the NVD.
- Isolate multi-tenant BTP applications from external network access where possible.
- Prepare a migration plan to version 0.45.2 once the update is confirmed stable.
Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses
General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-89111?
It is a critical SSRF vulnerability in the SAP Cloud SDK for Python that allows credential theft.
Which versions are affected?
Versions of the SAP Cloud SDK for Python prior to 0.45.2 are affected.
What is the CVSS score?
The NVD rates the vulnerability as CVSS 10 Critical.
