Habla con un experto
PreciosNoticiasHabla con un experto
Volver a la sala de prensa
Amenazas

SAP Cloud SDK for Python: CVSS 10 Flaw Can Leak OAuth2 Client Credentials

CVE-2026-89111 lets an attacker who controls a tenant subdomain redirect a BTP app's OAuth2 credential exchange. Several releases after the fix also lack the check. Here is which versions are safe.

4T4Tify Team4Tify
Oct 13, 2026·5 min de lectura
SAP Cloud SDK for Python: CVSS 10 Flaw Can Leak OAuth2 Client Credentials

SAP Cloud SDK for Python: CVSS 10 Flaw Can Leak OAuth2 Client Credentials

SAP has published an advisory for CVE-2026-89111, a maximum-severity (CVSS 10.0) server-side request forgery (SSRF) weakness in its Cloud SDK for Python, the official Python client for SAP Business Technology Platform (BTP) services. In affected releases, an application's OAuth2 client ID and client secret can end up at a server the attacker chooses. Independent testing also shows that the August fix stopped applying in some later releases.

What happened

Multi-tenant BTP applications tell the SDK which tenant a request belongs to by passing a tenant subdomain. The SDK then builds that tenant's token URL by putting the subdomain into the token endpoint from the app's configuration, and sends the app's client credentials there to get an access token.

Releases without the fix never validated the subdomain. If an attacker can influence that value, they can change the resulting URL so the credential exchange goes to infrastructure they control.

  • Fix: version 0.45.2 (August 21) added a check that accepts only a single DNS-style label (letters, digits and hyphens, up to 63 characters) and rejects anything else with an error. The fix covered the Agent Gateway, Destination and Document Management Service modules.
  • Regression: according to testing by The Hacker News, which ran SAP's own test cases against every release, versions 0.53.0 through 0.55.0 (September 10–18) skip the check on Destination service calls, and 0.55.0 also skips it for Document Management Service calls. The cause was a refactor onto shared token-request code that left out the validation. 0.55.1 (September 18) put the check back.
  • Legacy line: releases 0.36.1 and 0.36.2 came out after the August fix and still don't include it. No 0.36.x release has the check.
  • Disclosure: the vulnerable code had been in the SDK since its first PyPI release in March. The August release notes listed the change as a bug fix, and the advisory followed 53 days later. It credits researcher SunandM and does not report any exploitation in the wild.

As of October 13, the advisory lists only versions below 0.45.2 as affected. It doesn't say whether the regressed 0.53.0–0.55.0 releases fall under the same CVE.

Why it matters

Client credentials are the identity a BTP application uses to call other services. Whoever holds them can request tokens as that application. What an attacker could actually reach depends on the scopes granted to that client, and the advisory doesn't give details. The precondition is real but narrow: the flaw only matters where the app passes a tenant subdomain to the SDK and an attacker can control that value.

The regression is a second lesson. A patch can be undone by a later refactor. Teams that upgraded to 0.45.2 in August and kept updating could have landed back on an unprotected release in September.

What to do

  1. Inventory. Find every service and image that depends on sap-cloud-sdk for Python, and record the version that is actually pinned or resolved, not just the declared range.
  2. Upgrade to a protected release. Use the latest (0.58.4 as of October 13) or anything from 0.55.1 up. Releases 0.45.2–0.52.2 are also protected. Avoid 0.53.0–0.55.0 and the entire 0.36 line: upgrading within 0.36 won't add the check.
  3. If you can't upgrade yet, do what SAP recommends: validate every tenant subdomain against your list of registered tenants before passing it to the SDK.
  4. Consider rotating credentials. The advisory doesn't address rotation. Even so, if a multi-tenant app ran an unprotected release and took the tenant subdomain from input an attacker could influence, we recommend rotating that app's OAuth2 client secret as a precaution.
  5. Review logs for token requests to unexpected hosts, and for tenant subdomain values containing dots, slashes, @ or other URL delimiters.
  6. Guard against regressions. Add tests or software composition analysis (SCA) policy checks that flag known-bad version ranges, not just versions below the first fix.

Reporting credit: release-by-release test results by The Hacker News; vulnerability details from SAP's security advisory.

COMPARTIR