SAP Cloud SDK for Python OAuth2 SSRF leaks client credentials (CVE-2026-89111)

What happened

CVE-2026-89111 is a server-side request forgery in the OAuth2 flow of SAP Cloud SDK for Python. In a multi-tenant SAP Business Technology Platform application, an attacker can control the tenant_subdomain parameter. When the SDK builds an OAuth2 token request, that request can be redirected to a server the attacker controls, and OAuth2 client credentials are sent to that server instead of the legitimate identity provider.

The CVE record rates the issue critical with a CVSS 3.1 base score of 10. It is reachable over the network with low attack complexity, requires no privileges and no user interaction, and changes security scope. Confidentiality and integrity are rated high; availability is not affected.

The CVE record does not record active exploitation or public disclosure for CVE-2026-89111.

Who is affected

SAP Cloud SDK for Python, distributed as the Python package sap-cloud-sdk, is listed as affected in versions before 0.45.2 for SAP Cloud. The vulnerable scenario is a multi-tenant SAP Business Technology Platform application whose OAuth2 token request uses the tenant_subdomain parameter. If your Python services on SAP BTP issue OAuth2 client-credential tokens and derive the identity provider URL from tenant_subdomain, this advisory applies to you.

What to do now

SAP has not published a patched release or workaround for CVE-2026-89111 at the time of publication.

1. Identify every multi-tenant SAP BTP application that depends on sap-cloud-sdk before 0.45.2. Check Python project dependencies, container images and CI build outputs.
2. Treat affected applications as exposed and restrict access to the applications and their OAuth2 token endpoints to trusted networks until SAP publishes a fix.
3. Monitor outbound OAuth2 token requests from affected applications for destinations outside the expected identity provider domains.
4. Watch SAP Security Patch Day and the SAP Cloud SDK for Python GitHub security advisory for updates, and reassess exposure when SAP publishes one.

How to detect it

Review outbound proxy and application logs for OAuth2 token requests where the host resolves outside the expected identity provider domain. Look for tenant_subdomain values in request logs or traces that point to unknown external hosts. An attacker-controlled redirect will typically produce an outbound HTTPS connection from the affected application to a domain that is not part of the normal identity provider configuration.

Beyond the patch

As an SAP estate, this is as much a software-supply-chain problem as an application issue: SAP’s patch cadence defines the exposure window, and SAP has not published a fix for CVE-2026-89111. Our SAP HANA Security & Cloud Migration practice can review your Python services on BTP and the OAuth2 trust boundaries between tenants. Supply Chain Defense & Third-Party Risk can help you track which SAP Cloud SDK versions you run and when SAP publishes a fix, so this exposure does not become an incident.