Vulnerability · Published Oct 13, 2026 · Assigned by sap

CVE-2026-89111OAuth2 SSRF vulnerability in SAP Cloud SDK for Python

Critical 10.0

In plain English

A critical-severity server-side request forgery in SAP Cloud from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)0.4%top 68.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. This vulnerability was originally fixed in 0.45.2. It was reintroduced in 0.53.0 when the HTTP client was refactored into a shared core module, and the tenant subdomain validation was not carried over to the new location. The validation was restored in 0.55.1.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP Cloud	sap-cloud-sdk < 0.45.2>=0.53.0 – before 0.55.1

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

In plain English

Official description

Affected products (as reported)

References