CVE-2026-89111: OAuth2 SSRF vulnerability in SAP Cloud SDK for Python

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-13 · updated 2026-10-30
Weakness: CWE-918

Description

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.

Affected products

SAP_SE SAP Cloud: from >=0.53.0 before 0.55.1; sap-cloud-sdk < 0.45.2 — fixed in 0.55.1

How to fix

Upgrade to a fixed version: SAP_SE SAP Cloud 0.55.1. Check the vendor advisory for mitigations.

References

https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-4mv3-jxxm-9cx2
https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-89111 or the next vulnerability affects your stack