CVE-2026-89111: Critical SAP Cloud SDK for Python OAuth2 SSRF Bug Requires Upgrade

What the flaw is​

SAP describes the problem this way: the SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.

In a multi-tenant design, the tenant subdomain helps decide which authorization server the SDK contacts for a token. VulDB's analysis says the root cause is insufficient validation of user-supplied input in the tenant_subdomain parameter during the token request process. If an attacker can influence that value, the SDK may send its credential-bearing request to a server the attacker runs. Once the attacker holds those credentials, they can be used to impersonate legitimate users or services within the BTP environment.

Severity and affected versions​

• Identifier: CVE-2026-89111, with the GitHub advisory GHSA-4mv3-jxxm-9cx2.
• Affected: SAP lists the library as SAP Cloud SDK for Python, versions below 0.45.2. The fix is therefore 0.45.2 or later.
• Priority: Critical, CVSS 10.0.
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. In plain terms, it is network-reachable, low complexity, needs no privileges or user interaction, changes scope, and has high confidentiality and integrity impact. Availability is not affected.
• Weakness class: CWE-918, SSRF.

The SDK is a developer toolkit and not a packaged SAP product. SAP's SDK page says the Python SDK helps you build cloud-native AI agents and BTP integrations. Strictly, the SAP page's wording for this is a separate source, but the practical point is the same: exposure depends on whether your application uses this library. Owning SAP software is not enough to be affected.

Is it being exploited?​

I found no evidence of exploitation. Security aggregators report that the flaw is not in the CISA KEV catalog and no public proof-of-concept has been detected. SecurityOnline likewise reports that SAP does not report exploitation in the wild for any of these flaws.

That is a snapshot from launch day, not a guarantee. SSRF bugs with a CVSS of 10 and a simple trigger tend to attract attention quickly. Treat the lack of reported attacks as a window to patch, not a reason to wait.

What to do​

1. Inventory. Search dependency files, lockfiles, container images, build artifacts and deployed environments for the SAP Cloud SDK for Python. Find the version that actually resolves at runtime. This inventory step is my own operational suggestion based on SAP's version boundary. It is not a vendor-prescribed procedure.
2. Upgrade. Move any version below 0.45.2 to 0.45.2 or later, then rebuild and redeploy. Pinned versions in lockfiles and container layers will not update themselves.
3. Mitigate if you can't patch yet. SAP's advice is that consumer applications can validate tenant_subdomain against a known allowlist of registered tenant subdomains before passing it to any SDK call. This is a stopgap and not a substitute for the update.
4. Check where the value comes from. Look for any code path where tenant_subdomain is built from request headers, URLs, or other user-influenced data. Those paths are where an attacker would get control of the parameter.
5. Consider rotating credentials. If you suspect an exposed app may have sent credentials to an unexpected host, rotating the client credentials is a sensible precaution. SAP's advisory does not prescribe this step, and I have no evidence of any compromise.

The rest of the October batch​

The other critical items are separate flaws and should not be conflated with this one. According to SAP's bulletin:

• CVE-2026-89110: broken access control in NetWeaver Visual Composer, CVSS 9.9, affecting VC70RUNTIME 7.50.
• CVE-2026-89107: code injection in S/4HANA Manage Substitution/Validation Rules, CVSS 9.9, affecting S4CORE 105 to 109.
• CVE-2026-89108: missing authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service), CVSS 9.1, affecting XMII 15.4 and 15.5.
• CVE-2026-89113: SQL injection in Commerce Cloud, rated High at CVSS 8.8, affecting COM_CLOUD 2211-JDK21.

Counts of the October fixes vary between outlets. BleepingComputer says 20 flaws. SAP's bulletin lists 16 notes plus 4 GitHub advisories, and GBHackers counts 22 CVEs once the two updated notes are included. The differences likely come from what each outlet counts, such as updated older notes, so use SAP's own list as the authority.

Why this one deserves attention​

Most SAP patch days are about patching servers. This one is about a library inside your own code, which means a vendor patch day will not fix it for you. The update only helps once your team changes the dependency, rebuilds and redeploys.

Credential-stealing SSRF in an authentication flow is also a reminder of a basic rule. Anything that picks a destination for a token request, including a tenant name, must come from a trusted list and never from raw input.

Bottom line: if you build Python apps on SAP BTP, find out which SDK version you run, upgrade to 0.45.2 or later, and allowlist tenant subdomains until you have done so.