CVE-2026-89111 is a critical OAuth2 server-side request forgery (SSRF) flaw (CVSS 10.0) in the SAP Cloud SDK for Python. According to the CNA description, an attacker could use it to redirect token requests and capture client credentials from multi-tenant SAP BTP applications where the attacker can influence the tenant_subdomain parameter.
What Is It
The SAP Cloud SDK for Python has an OAuth2 SSRF vulnerability (CWE-918) that affects multi-tenant SAP Business Technology Platform (BTP) applications. The CNA description says an attacker who controls the tenant_subdomain parameter can send OAuth2 token requests to a server the attacker controls. The application then sends its client credentials to that server, and the attacker collects them.
SAP ([email protected]) is the CNA that published the record. NVD lists its status as "Received," which means NVD hasn't finished its own analysis yet.
Why It Matters
SAP gives the flaw the maximum CVSS v3.1 base score of 10.0 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N:
- Network-reachable with low attack complexity
- No privileges and no user interaction required
- Scope changed: the impact reaches beyond the vulnerable component
- High confidentiality and integrity impact, with no availability impact
The main risk is theft of OAuth2 client credentials. With stolen credentials, an attacker could request tokens as the application and act with its permissions. Because the scope is "changed," the damage can spread to other services that trust those credentials.
Exploitation status: The supplied CISA KEV entry is empty, so KEV doesn't currently confirm active exploitation of this CVE.
What's Vulnerable
- Vendor: SAP SE
- Product: SAP Cloud (
sap-cloud-sdkPython package) - Affected versions:
sap-cloud-sdk< 0.45.2 - Default status: unaffected (only the listed version range is affected)
- Exposure condition: multi-tenant BTP applications where an attacker can influence the
tenant_subdomainparameter
The NVD record doesn't list any CPEs yet.
Patch Status
The record lists sap-cloud-sdk versions below 0.45.2 as affected, which suggests 0.45.2 is the first unaffected release. The supplied data doesn't name a fixed version outright, so check the vendor advisory before rolling out. Recommended actions:
- Find Python workloads that depend on
sap-cloud-sdkand upgrade any version below 0.45.2. - Check the SAP Security Patch Day page for official fix and mitigation guidance.
- Note that the linked GitHub security advisory is hosted in the
SAP/cloud-security-services-integration-libraryrepository, not in a SAP Cloud SDK for Python repository. Before you rely on its guidance forsap-cloud-sdk, confirm that it actually covers this package.
No CISA KEV required action or due date applies, because this CVE has no KEV entry.