Science & Tech · Cybersecurity · 1 hr ago
SAP fixes maximum-severity flaw in its Python Cloud SDK
SAP patched 20 security flaws across its products in its October 2026 updates.
The most severe issue is in the Cloud SDK for Python, used to build applications and AI agents on SAP's Business Technology Platform.
The flaw affects multi-tenant applications and could let a remote attacker redirect token requests to steal credentials without needing access privileges.
SAP says customers who cannot install the updates immediately can check tenant subdomains against an allowlist as a temporary safeguard.
The update also fixes two critical flaws in other SAP products, including one that could allow a remote attacker with limited privileges to compromise a system.
Customers should apply the October patches; the advisory gives no further timetable for what happens next.
SAP fixed a maximum-severity vulnerability in its Cloud SDK for Python as part of its October 2026 security updates.
Tracked as CVE-2026-89111, the flaw could let remote attackers without privileges steal credentials.
The vulnerability affects multi-tenant applications on SAP Business Technology Platform that use OAuth2.
Attackers who control the tenant_subdomain parameter can redirect OAuth2 token requests to a server they control.
SAP advised customers to apply the patches or temporarily validate tenant_subdomain values against an allowlist.
- Who
- Remote attackers without privileges could exploit the flaw. SAP issued the security update.
- What
- SAP fixed a maximum-severity OAuth2 server-side request forgery vulnerability in its Cloud SDK for Python.
- When
- October 2026. The article was published on 13 October 2026.
- Where
- The SAP Cloud SDK for Python, used with multi-tenant applications on SAP Business Technology Platform.
- Why
- The flaw could allow attackers to redirect OAuth2 token requests and steal client credentials.
This story does not have two clearly opposing sides.
This story does not have a timeline yet.
- Vulnerability
- CVE-2026-89111
- Severity
- Maximum
- Affected product
- SAP Cloud SDK for Python
- Attack method
- Redirecting OAuth2 token requests by controlling tenant_subdomain
- Temporary mitigation
- Validate tenant_subdomain against an allowlist of registered tenant subdomains
What people are saying
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications.
An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.
Consumer applications can mitigate the vulnerability by validating tenant_subdomain against a known allowlist of registered tenant subdomains before passing it to any SDK call.
Sources
Related news
Cyberattack disrupts refrigeration at hundreds of French supermarkets
Cyberattack disrupts IT systems at three TFG London fashion brands
GitLab fixes maximum-severity flaw that could let attackers run server code
Ledger links CryptoBilis wallet implants to confirmed crypto thefts
Cyberattacks target refrigeration systems at more French supermarkets
Ahold Delhaize takes some systems offline after cyberattack
CISA adds five exploited software flaws amid China-linked espionage concerns
Trellix launches on-premises AI tool for security investigations
Only 25% of cybersecurity teams use agentic AI for defense
Canadian cybersecurity executive arrested in ShinyHunters investigation
Cyberattack disrupts internet services at St. Petersburg provider