Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-89111: SAP Cloud SDK for Python can leak OAuth tokens
CVE-2026-89111 · published 6 days ago
Summary
The SAP Cloud SDK for Python used in multi‑tenant Business Technology Platform apps can be tricked into sending its token‑request traffic to a server the attacker controls. This could let the attacker steal the credentials the app uses to access other services. Apply the vendor’s update or patch, restrict how the tenant subdomain is set, and rotate any exposed credentials.
Original advisory text
OAuth2 SSRF vulnerability in SAP Cloud SDK for Python
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.
References
- https://github.com/SAP/cloud-security-services-integration-library/security/advi...
- https://url.sap/sapsecuritypatchday URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89111... Vendor Advisory
- https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-4mv3-jxxm-9cx2 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-89111 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published13 Oct 2026
Updated17 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta