Critical OAuth2 SSRF in SAP Cloud SDK for Python Exposes Client Credentials
A vulnerability in the SAP Cloud SDK for Python allows attackers to redirect token requests, leading to credential theft in multi-tenant BTP applications.
Key points
- CVE-2026-89111 is rated Critical by the NVD due to its potential for credential exfiltration.
- The flaw affects versions of the SAP Cloud SDK for Python prior to 0.45.2.
- Attackers exploit the tenant_subdomain parameter to send OAuth2 requests to malicious servers.
The U.S. National Vulnerability Database has assigned a Critical severity rating to CVE-2026-89111, a flaw in the SAP Cloud SDK for Python that enables server-side request forgery within OAuth2 flows. This vulnerability allows attackers to redirect authentication requests, resulting in the theft of sensitive client credentials from multi-tenant Business Technology Platform applications.
At a glance
- CVE
- CVE-2026-89111
- Product
- SAP_SE SAP Cloud
- CVSS
- 10 Critical
- Weakness
- server-side request forgery
- Exploited
- No known exploitation
According to the NVD record, the weakness is classified under CWE-918. An attacker who gains control over the tenant_subdomain parameter can manipulate the destination of OAuth2 token requests. Instead of reaching the legitimate authorization server, these requests are sent to an attacker-controlled server. This redirection causes the application to transmit client credentials to the malicious endpoint, effectively exfiltrating them.
Context and Background
The National Vulnerability Database lists CVE-2026-89111 with a CVSS score of 10, which falls into the highest severity category. The record identifies the specific weakness as CWE-918, which relates to server-side request forgery. This type of vulnerability typically arises when a server processes an incoming request and makes another request based on that input without sufficient validation.
In this specific case, the SAP Cloud SDK for Python fails to adequately validate the tenant_subdomain parameter. The description in the NVD record states that an attacker controlling this parameter can redirect OAuth2 token requests. The consequence of this redirection is the exfiltration of client credentials. The NVD record does not specify whether this flaw is currently being exploited in the wild, but the high severity indicates significant risk.
Who Is Affected
The vulnerability specifically impacts users of the SAP Cloud SDK for Python. According to the NVD, the affected software is produced by SAP SE. The component at risk is the sap-cloud-sdk. The NVD record specifies that versions prior to 0.45.2 are vulnerable to this attack. Organizations using this Python library to build multi-tenant applications on the SAP Business Technology Platform are directly exposed to this threat.
The risk is particularly acute for multi-tenant architectures, where a single instance of the software serves multiple separate tenants. If an attacker can influence the tenant_subdomain parameter, they can target the authentication flow for any tenant hosted on the affected application. This could lead to a widespread compromise of client credentials across multiple tenants if the underlying SDK is not updated to the patched version.
What should you do?
Security professionals should immediately audit their Python projects for dependencies on the SAP Cloud SDK. It is essential to verify the installed version against the NVD record. Any installation running a version older than 0.45.2 is considered vulnerable and requires attention. Organizations should prioritize updating the library to version 0.45.2 or later to mitigate the risk of credential exfiltration via the tenant_subdomain parameter.
What to do and how to stay safe: SAP
- Check your Python environment for the sap-cloud-sdk package and verify if the version is below 0.45.2.
- Review network logs for any OAuth2 token requests being sent to unexpected or unauthorized destinations, which could indicate exploitation.
- Ensure that input validation for tenant-related parameters is strict and that only whitelisted domains are allowed for token requests.
- Monitor security advisories from SAP SE for any additional details or temporary workarounds if an immediate update is not feasible.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-89111?
It is a Critical severity vulnerability in the SAP Cloud SDK for Python that allows server-side request forgery in OAuth2 flows, leading to credential theft.
Which versions of the SAP Cloud SDK are affected?
All versions of the sap-cloud-sdk for Python prior to 0.45.2 are affected by this vulnerability according to the NVD record.
How does an attacker exploit this flaw?
An attacker controls the tenant_subdomain parameter to redirect OAuth2 token requests to a malicious server, causing client credentials to be sent there.
