SAP Cloud SDK for Python OAuth2 SSRF lets attackers steal client credentials (CVE-2026-89111)

What happened

SAP Cloud SDK for Python contains an OAuth2 server-side request forgery in multi-tenant SAP Business Technology Platform (BTP) applications. An attacker who controls the tenant_subdomain parameter can cause the SDK to send OAuth2 token requests to an attacker-controlled server instead of the legitimate token endpoint. Client credentials passed with those requests can be exfiltrated. The CVSS 3.1 score is 10.0, critical. The score reflects that the vulnerability is reachable over the network, requires no privileges or user interaction, and can compromise confidentiality and integrity of other components; availability is not affected. The CVE record does not state that exploitation has been observed.

Who is affected

Affected is the SAP Cloud SDK for Python, used in multi-tenant SAP Business Technology Platform applications. The vulnerable version ranges are sap-cloud-sdk versions below 0.45.2, and versions from 0.53.0 up to but not including 0.55.1. The fixed release listed by SAP is SAP Cloud 0.55.1. No other products are named in the CVE record.

What to do now

1. Upgrade the Python sap-cloud-sdk package to the fixed release SAP Cloud 0.55.1, particularly for multi-tenant BTP applications. 2. If you cannot upgrade immediately, restrict tenant_subdomain values to expected tenant identifiers at the application or gateway layer where possible, and monitor outbound OAuth2 token requests. 3. Rotate OAuth2 client credentials that may have been involved in redirected token requests as a precaution. The CVE record does not list a workaround; upgrading is the available remediation.

How to detect it

Monitor outbound OAuth2 token requests from applications using the SAP Cloud SDK for unexpected destination hosts. The vulnerability works by redirecting these requests to an attacker-controlled server, so token requests to domains other than your expected identity provider or SAP token endpoint merit investigation. Review application logs for unusual tenant_subdomain values.

Beyond the patch

Beyond the patch, this is a reminder of how an SDK dependency can become the entry point for credential theft. Our SAP HANA Security & Cloud Migration practice can review multi-tenant BTP application configurations and OAuth2 client handling across your SAP estate. Because the exposure window is set by how quickly development teams adopt fixed SDK versions, tracking which SAP Cloud SDK versions you run and how fast they are updated is part of Supply Chain Defense & Third-Party Risk.