Vulnerability Intelligence Report
OAuth2 SSRF vulnerability in SAP Cloud SDK for Python
CVE-2026-89111
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. This vulnerability was originally fixed in 0.45.2. It was reintroduced in 0.53.0 when the HTTP client was refactored into a shared core module, and the tenant subdomain validation was not carried over to the new location. The validation was restored in 0.55.1.
No Active Exploit Signals
CVSS Base Score
10.0
CRITICAL
Exploitability:3.9
Impact Score:5.8
EPSS Probability:0.37%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-918 ↗CWE-918: Server-Side Request Forgery
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| SAP_SE | SAP Cloud | sap-cloud-sdk < 0.45.2 (affected), >=0.53.0 < 0.55.1 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.372%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | SAP SE · Vendor · Germany |
| Reserved | 2026-09-10T22:24:03 |
| Published | 2026-10-13T00:24:28 |
| Last Updated | 2026-11-03T19:30:58 |
Community Chatter & Buzz