CVE-2026-89111
SAP Cloud SDK for Python OAuth2 SSRF exfiltrates client credentials (CVE-2026-89111)
SAP Cloud SDK for Python has an OAuth2 SSRF flaw in multi-tenant BTP apps. An attacker controlling tenant_subdomain can redirect token requests over the network with no credentials or user action, exfiltrating client credentials. Update to SAP Cloud 0.55.1.
What happened
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. The flaw is reachable over the network, requires no privileges or user interaction, has high impact on confidentiality and integrity, and no impact on availability; the CVSS 3.1 score is 10.0.
No exploitation is currently reported, and CISA's KEV catalogue does not list this CVE. SAP has not stated whether the issue has been observed in the wild.
Who is affected
The affected component is the SAP Cloud SDK for Python. Affected version ranges are sap-cloud-sdk < 0.45.2 and >=0.53.0 to before 0.55.1. This matters mainly for multi-tenant BTP applications that perform OAuth2 token requests, because the SDK is embedded in custom code rather than running as a standalone service. Organisations should inventory every application and service that uses the SDK in those ranges.
What to do now
- Update affected applications to the fixed release, SAP Cloud 0.55.1.
- Locate every multi-tenant BTP application using
sap-cloud-sdk < 0.45.2or>=0.53.0 to before 0.55.1, including internally developed and third-party code. - Rebuild and redeploy those applications after the upgrade, and confirm that OAuth2 token requests are directed only to the configured token endpoint.
SAP has not published a workaround.
Beyond the patch
This is a library-level flaw in code you compile into applications, not a single SAP system that can be patched centrally. The real work is inventory: knowing every BTP application built with an affected sap-cloud-sdk version and then tracking SAP's patch cycle so the 0.55.1 update reaches each codebase. Our SAP HANA Security & Cloud Migration practice helps map SAP BTP and SDK usage, while Supply Chain Defense & Third-Party Risk tracks the vendor software you depend on and how quickly fixes arrive.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| SAP Cloud | sap-cloud-sdk < 0.45.2 >=0.53.0 – < 0.55.1 | 0.55.1 |