SAP released sap-cloud-sdk 0.45.2 on October 13, 2026, correcting a maximum-severity server-side request forgery vulnerability that can expose OAuth2 client credentials from multi-tenant SAP Business Technology Platform applications.
The flaw, tracked as CVE-2026-89111 and GHSA-4mv3-jxxm-9cx2, affects every version of the SAP Cloud SDK for Python before 0.45.2. SAP published its GitHub security advisory on October 13, 2026 and credited SunandM with reporting the issue.
Attacker-controlled tenant data can redirect token requests
CVE-2026-89111 is an OAuth2 SSRF vulnerability classified as CWE-918. It arises when an attacker can control the tenant_subdomain parameter used by a multi-tenant BTP application.
The vulnerable SDK can substitute that value into the URL used for an OAuth2 token request. A malicious value can therefore direct the request to an attacker-controlled server, exposing the client credentials sent during the exchange.
SAP’s CVSS v3.1 vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
This describes a network-accessible attack requiring neither privileges nor user interaction. SAP’s CNA assessment, also displayed by GitHub, assigns a 10.0 Critical score, with high confidentiality and integrity impact but no availability impact. The NVD record did not yet contain a separate NIST score on October 13, 2026.
Upgrade to sap-cloud-sdk 0.45.2
Organizations running affected BTP applications should update the Python package to version 0.45.2 or later. The corrected release checks tenant_subdomain against RFC 1123 DNS label requirements before inserting it into a token URL.
Where an immediate update is not possible, SAP advises consumer applications to validate tenant_subdomain against an allowlist containing registered tenant subdomains. That check must occur before the value is passed to any SDK call.
Teams should account for deployed applications and locked dependencies rather than checking only development environments: any application running sap-cloud-sdk below 0.45.2 remains within the affected range.
Two more critical flaws addressed in SAP’s October release
SAP’s October 13, 2026 security release covers 20 vulnerabilities across its products. Two other critical issues carry significant system-compromise risks:
- CVE-2026-89110 is a broken access-control vulnerability in SAP NetWeaver Visual Composer. A low-privileged attacker can invoke internal operations on a preconfigured remote system. Depending on that connection’s configuration, exploitation could fully compromise the remote system. It has a CVSS score of 9.9 and is classified as CWE-749.
- CVE-2026-89108 affects administrative functionality in SAP Manufacturing Integration and Intelligence. An attacker who already has MII administrator privileges can submit a crafted request that provisions an elevated account on the underlying Java application server, potentially gaining administrative control beyond the vulnerable application. It has a CVSS score of 9.1 and is classified as CWE-862.
The immediate action for Python-based, multi-tenant BTP deployments is to move to sap-cloud-sdk 0.45.2 or enforce SAP’s tenant-subdomain allowlist workaround until the update can be installed.
