high Cve 2026 89111 · Exploits

SAP Cloud SDK for Python OAuth2 SSRF (CVE-2026-89111, CVSS 10.0) Leads October Patch Day

Data graphic: SAP Cloud SDK for Python OAuth2 SSRF, CVE-2026-89111, rated CVSS 3.1 Critical at 10.0, with a stamp reading "None reported" for exploitation. Fixed in version 0.45.2, weakness CWE-918 SSRF.

Alex Kim
Threat intelligence editor · Published Oct 13, 2026, 6:43 AM EDT

A tenant_subdomain value can redirect OAuth2 token requests and leak client credentials in SAP's Python SDK. Three more critical SAP flaws shipped; no exploitation reported.

SAP's October 13 Security Patch Day includes CVE-2026-89111, a server-side request forgery (SSRF) flaw in the SAP Cloud SDK for Python (sap-cloud-sdk on PyPI) that carries the maximum CVSS 3.1 score of 10.0. If an attacker controls the tenant_subdomain value a multi-tenant SAP BTP application passes to the SDK, OAuth2 token requests can be sent to a server the attacker runs, and the application's client credentials go with them. Three more critical SAP flaws shipped the same day. No source we read reports exploitation of any of the four, and none was in CISA's Known Exploited Vulnerabilities (KEV) catalog when we checked.

What happened

SAP's patch-day page lists 16 new security notes, four GitHub security advisories and two updates to earlier notes. CVE-2026-89111 is one of the GitHub advisories: the repository advisory is GHSA-4mv3-jxxm-9cx2, which NVD and SAP cite. A second identifier, GHSA-m3j7-wp2j-mhc3, is GitHub's global advisory entry for the same CVE and points back to it. The CVE record was reserved on September 10 and published on October 13. NVD had not analysed it yet, so the 10.0 score shown is the one SAP supplied as the CNA.

The CVE description says the SDK "contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications" and that an attacker who controls tenant_subdomain can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. The advisory credits the report to a GitHub user, SunandM.

The same day brings three other critical-rated flaws, covered in the patch batch below.

Why it matters

The vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N: network-reachable, low complexity, no privileges, no user interaction, changed scope, high confidentiality and integrity impact, no availability impact. The 10.0 reflects that profile. It does not say how many applications are exposed, and the advisory does not either.

What decides exposure is whether your application lets an outside party influence tenant_subdomain. In a multi-tenant application that value often comes from a request, a hostname or a tenant lookup. If it comes only from a trusted internal source, the path in the CVE description is not open to an outsider. That is our reading of the advisory's conditions, not a statement from SAP.

What leaks is the application's OAuth2 client ID and secret. Those authenticate the application to the token service, so anyone holding them can request tokens as that application. How far that reaches depends on the scopes granted to the client, which neither SAP nor the advisory describes.

Technical details

The SDK builds a token URL by substituting the tenant subdomain into a base URL. When the substituted value is not constrained to a DNS label, it can change which host receives the request. The repository's own follow-up pull request (#345) gives the example evil.example/oauth/token?ignore=: used as a tenant name, it moves the URL's authority to the attacker's host, and client_id and client_secret are posted there. (We covered other SSRF flaws recently, including the SonicWall SMA1000 pre-auth SSRF, the Dify remote-file upload SSRF and the MCP fetch server SSRF.)

Fix. The advisory lists the vulnerable range as < 0.45.2 and the patched release as 0.45.2. Release 0.45.2 (PyPI, August 21) validates tenant_subdomain against RFC 1123 DNS-label rules before substituting it, in three places: AgentGatewayClient._resolve_tenant_subdomain, destination.TokenProvider.get_token and dms.Auth._resolve_token_url. Invalid values raise ValueError: dots, spaces, underscores, slashes, leading or trailing hyphens, and anything over 63 characters. The 0.45.2 release notes do not mention a security issue, and the fix shipped about seven and a half weeks before the CVE was published.

Why 0.45.2 may not be the safe floor. On September 18 the project released 0.55.1, whose notes list "Tenant-subdomain URL injection". The pull request behind it (#345) adds the same validation to XsuaaAuthProvider._fetch_token. When we read src/sap_cloud_sdk/core/protocol/http/models.py at tag v0.55.0, that class still built the token URL with str.replace(identityzone, tenant_subdomain) and no validation; the file is not at that path in v0.45.1 or v0.45.2. That suggests versions from 0.45.2 up to 0.55.0 may still have been exploitable through the XSUAA code path. This is our inference from the code and the PR text. SAP's advisory does not say it, and we did not run the code. A later release, 0.58.3 (October 9), replaces the string replacement with a function that swaps only the leading hostname label; the release notes list it as a fix for "Tenant token URL injection". The latest release on PyPI when we checked was 0.58.4 (October 13).

Treat the current release as the floor rather than 0.45.2.

The rest of the patch batch

All three are rated by SAP as network-reachable with low complexity. Details beyond the CVE text sit in SAP notes behind a support login, which we could not read.

CVE	Product	SAP note	CVSS 3.1	Condition	Weakness
CVE-2026-89110	NetWeaver Visual Composer (VC70RUNTIME 7.50)	3797111	9.9	Low privileges	CWE-749
CVE-2026-89107	S/4HANA, Manage Substitution/Validation Rules (S4CORE 105–109)	3805589	9.9	Authenticated, specific business privileges	CWE-94
CVE-2026-89108	Manufacturing Integration and Intelligence, Configuration Service (XMII 15.4, 15.5)	3798788	9.1	High privileges (MII administrator)	CWE-862

CVE-2026-89110: insufficient authorization checks in certain portal functionality let a low-privileged attacker invoke internal operations on a preconfigured remote system. Depending on how that remote connection is configured, the result can be full compromise of the remote system.
CVE-2026-89107: an authenticated user with specific business privileges submits crafted input in a domain-specific scripting language that is interpreted as executable ABAP code.
CVE-2026-89108: a Manufacturing Integration and Intelligence administrator can provision an account with elevated privileges on the underlying Java application server.

The October batch also includes a Commerce Cloud SQL injection (CVE-2026-89113, 8.8), a NetWeaver / Web Dispatcher ICM memory corruption flaw (CVE-2026-58249, 7.5) and an ABAP Platform flaw (CVE-2026-89120, 7.1).

ThreatFrontier has covered SAP NetWeaver exploitation before: see SAP patches a second critical NetWeaver flaw after researchers link it to chained zero-day attacks. That story involved flaws that were exploited. The four CVEs here are different, and we have no report of exploitation.

What defenders should do

Find the package. Search Python environments, lockfiles and container images for sap-cloud-sdk. Upgrade to the current release (0.58.4 at time of writing) rather than stopping at 0.45.2, for the reason above.
Trace tenant_subdomain. Find every place your application takes a tenant name from a request, header or hostname and passes it to the SDK. The advisory's workaround is to validate it against a known allowlist of registered tenant subdomains before any SDK call. That is worth doing even after upgrading.
If an exposed application ran an affected version, consider rotating its OAuth2 client secret. Whether that is warranted depends on whether outsiders could set the value; SAP reports no exploitation, and rotation is our suggestion, not SAP's. Review token-service logs for requests from unexpected sources.
Apply the SAP notes for the three other critical flaws on your normal critical-patch schedule, starting with systems where Visual Composer is reachable by low-privileged users and S/4HANA systems where many users hold business privileges. The notes name the fixed support-package levels; they require an SAP login.

What is still unclear

Exploitation. Neither SAP's patch-day page nor the advisory reports exploitation, and a secondary outlet (SecurityOnline) says none is confirmed and no public proof of concept exists. CISA's KEV feed we read was last released on October 8 and listed none of the four CVEs; the CVE records are a day old, so recheck.
The true vulnerable range. Whether 0.45.2 through 0.55.0 remain exploitable through the XSUAA path is our inference, not a confirmed fact.
Scope of exposure. Nobody has published how many BTP applications pass untrusted input as tenant_subdomain.
The three SAP-note flaws. The affected-component detail comes from the CVE records; we could not read the notes themselves. NVD analysis is still pending for these records, and the scores come from SAP as CNA.