Skip to content
Hacker Posts

SAP Cloud SDK for Python OAuth2 SSRF (CVE-2026-89111, CVSS 10.0)

An unauthenticated SSRF in SAP Cloud SDK for Python lets an attacker who controls tenant_subdomain redirect OAuth2 token requests and steal client credentials. Fixed in 0.45.2.

Published 3 min read
cvesapssrfadvisory

SAP patched a CVSS 10.0 server-side request forgery flaw in SAP Cloud SDK for Python, the library used to build AI agents and Python apps on SAP Business Technology Platform (BTP). CVE-2026-89111 lets a remote, unauthenticated attacker redirect OAuth2 token requests to a server they control — and walk away with the application's client credentials. The fix is in sap-cloud-sdk 0.45.2.

The primary source is SAP's own advisory on GitHub, GHSA-4mv3-jxxm-9cx2, published alongside SAP's October 2026 security notes.

What's affected

  • Package: sap-cloud-sdk on PyPI.
  • Affected versions: all releases before 0.45.2.
  • Fixed in: 0.45.2.
  • Exposure: multi-tenant BTP applications that pass a caller-influenced tenant_subdomain into the SDK.

The flaw

The SDK builds an OAuth2 token endpoint URL from the tenant_subdomain parameter without validating it. An attacker who controls that value — in a multi-tenant app, that can be a request-supplied field — points the token request at an attacker-controlled host. The SDK then sends the OAuth2 client credentials to that host.

SAP classifies it as CWE-918 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N: network-reachable, no privileges, no user interaction, scope changed, high confidentiality and integrity impact. Leaked BTP client credentials are the keys to whatever that service account can reach.

Version 0.45.2 validates tenant_subdomain against RFC 1123 DNS-label rules before it is placed into the token URL.

Exploitation status

No in-the-wild exploitation has been reported. There is no public PoC at the time of writing, and SAP's advisory does not cite active abuse. The bug is trivial to reach in any app that forwards a tenant identifier into the SDK, so treat the window as short.

Action checklist

  1. Upgrade sap-cloud-sdk to 0.45.2 or later in every service that pulls it — including agent/automation code where it may be a transitive dependency.
  2. If you cannot upgrade immediately, validate tenant_subdomain against an allowlist of registered tenant subdomains before passing it to any SDK call, per SAP's workaround.
  3. Rotate the OAuth2 client credentials used by any affected BTP app that was internet-reachable before patching. If the SSRF fired, those secrets are burned.
  4. Grep your dependency tree (pip freeze, lockfiles) for sap-cloud-sdk to find services you forgot were running it.

Context

This is the second SAP flaw to land a top-end CVSS this cycle. In September we covered CVE-2026-44747, a memory-corruption bug in NetWeaver ABAP. The pattern worth noting here is different: the vulnerable code isn't a monolithic SAP server but a pip-installable SDK aimed at the AI-agent build-out, where a credential-leaking SSRF rides into production inside someone else's application. Library CVEs age in deployment images long after the vendor ships the fix — inventory your dependencies, not just your SAP landscape.

Related stories