EXPOSURES › CVE-2026-89111
CVE-2026-89111
CRITICALSAP Cloud SDK for Python OAuth2 SSRF flaw leaks client credentials when tenant_subdomain is manipulated.
An attacker controlling the tenant_subdomain parameter can redirect OAuth2 token requests to a malicious server, exfiltrating client credentials. DIB orgs must patch this immediately as it enables credential theft and violates NIST 800-171 controls on access control and network security. Update the SAP Cloud SDK for Python to the patched version and audit tenant_subdomain usage in multi-tenant BTP applications.
Shame score — A critical SSRF vulnerability in a widely used SDK allows credential exfiltration, indicating a significant gap in secure coding practices for multi-tenant cloud applications.
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.