SAP Cloud SDK for Python bug can leak OAuth2 secrets

SAP has fixed a maximum-severity flaw in its Cloud SDK for Python that can hand an app's login secrets to an attacker. The bug, CVE-2026-89111, scores 10.0 out of 10 and was patched in SAP's October 2026 security updates on October 13. It affects apps that serve many customers from one deployment, and the attacker does not need to log in.

The SAP Cloud SDK for Python is a library developers use to build apps on SAP's Business Technology Platform, or BTP. BTP is SAP's cloud service for running custom apps alongside SAP systems. The flaw sits in how the library asks for OAuth2 tokens, the short-lived passes an app uses to call other services.

How the attack works

The bug is a server-side request forgery, or SSRF. That means an attacker tricks a server into sending a request to a place the attacker chooses. SAP's GitHub advisory, quoted by SecurityWeek, puts it plainly: "An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests."

Here is the chain in plain terms:

1. A multi-tenant app builds the address of its token server from a tenant's subdomain, the customer-specific part of a web address.
2. The library did not check that value closely enough.
3. An attacker supplies a subdomain that points somewhere else.
4. The app sends its token request there, with its client ID and client secret attached.

Those two values are the app's own credentials. With them, an attacker can ask for tokens as if they were the app. SOCRadar notes that the flaw does not on its own give admin access or let an attacker run code.

Which versions are affected

SOCRadar lists the versions and fixes:

Versions	Status
Below 0.45.2	Vulnerable
0.45.2	Official fix: checks the subdomain against DNS naming rules
0.53.0 to 0.55.0	Validation gap reported independently, outside SAP's advisory
0.55.1	Validation restored

The 0.53.0 to 0.55.0 gap comes from SOCRadar alone. SAP's advisory does not cover it, so treat 0.55.1 or later as the safe floor. The project's GitHub page lists 0.60.1 as its newest release, dated October 17. That release fixes a separate URL path injection bug in a document client. An October 9 release also fixed how tenant token URLs are built.

SOCRadar said on October 14 that no attacks had been reported. SecurityWeek also says SAP reports no exploitation in the wild.

The rest of SAP's October patch day

The SDK flaw was one of four critical issues, BleepingComputer and SecurityWeek report:

CVE	Product	Score	Problem
CVE-2026-89111	Cloud SDK for Python	10.0	OAuth2 SSRF, no login needed
CVE-2026-89110	NetWeaver Visual Composer	9.9	Broken access control
CVE-2026-89107	S/4HANA	9.9	Code injection by users with one Fiori role
CVE-2026-89108	Manufacturing Integration and Intelligence	9.1	Missing authorization check

The outlets count the batch differently. BleepingComputer says 20 flaws, SecurityWeek says 22 new and updated notes, and SOCRadar counts 16 new notes plus four GitHub advisories.

What this means for developers

If you ship a multi-tenant BTP app in Python, check your dependency file today. Search for the SDK and note its version. The fix is a library upgrade, not a server patch, so it only reaches users when you redeploy.

• Upgrade to the latest release, which is past both 0.45.2 and 0.55.1.
• Allowlist tenant names if you cannot upgrade yet. SAP's advisory recommends "validating tenant_subdomain against a known allowlist," BleepingComputer reports.
• Rotate the client secret if you have any doubt. SOCRadar advises reviewing OAuth2 token traffic and BTP audit logs. If you see token requests to unknown hosts, assume the secret is gone.
• Look at your own input handling. Any code that builds a URL from a customer-supplied value has the same shape of risk, whatever library it uses.

Single-tenant apps that never take a subdomain from user input are much less exposed. But a CVSS 10.0 score in a library is easy to miss, because no SAP server patch will fix it for you.