CVE-2026-89111: critical vulnerability in SAP_SE SAP Cloud
OAuth2 SSRF vulnerability in SAP Cloud SDK for Python
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 0.4%
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.
This vulnerability was originally fixed in 0.45.2. It was reintroduced in 0.53.0 when the HTTP client was refactored into a shared core module, and the tenant subdomain validation was not carried over to the new location. The validation was restored in 0.55.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected products
SAP_SE · SAP Cloud