SAP has disclosed a severe vulnerability in its Cloud SDK for Python that could allow attackers to steal OAuth2 credentials. The flaw, identified as CVE-2026-89111, carries the maximum CVSS score of 10.0. It affects multi-tenant apps built on the SAP Business Technology Platform (BTP) that rely on this SDK for authentication.
What Went Wrong?
The issue centers on how tenant subdomains are handled when the SDK builds URLs to request access tokens. Without proper validation, malicious actors who gain control of a tenant subdomain can force the SDK to redirect credential requests to endpoints they control. Specifically, versions prior to 0.45.2—and a subset in later lines—failed to verify that tenant subdomains are simple names without URL delimiters. In flawed releases, the SDK could send client ID and secret data to attacker-controlled servers, a classic server-side request forgery (SSRF) risk.
SAP released version 0.45.2 on August 21, adding a strict check that tenant subdomains must consist only of letters, numbers, and hyphens (up to 63 characters), rejecting anything else. But in releases 0.53.0 through 0.55.0 (September), the validation was accidentally bypassed for certain modules (Destination and Document Management Service). The check was restored in version 0.55.1 on September 18, and remains present through the most recent 0.58.4 on PyPI. Older 0.36-line releases still lack this protection.
Affected Versions & Mitigations
SDK versions confirmed to include the tenant-subdomain check are: 0.45.2 through 0.52.2, and 0.55.1 through 0.58.4. Versions below 0.45.2 (including 0.36.1 and 0.36.2) are vulnerable. The flaw matters only for applications that actually pass a tenant subdomain to the SDK. SAP’s advisory recommends upgrading to a version that includes the check. For those unable to immediately upgrade, a suggested interim defense is verifying tenant subdomains against a whitelist of registered values before they are passed to the SDK.
The vulnerability was present since the SDK’s initial release on PyPI back on March 16. Although the fix was made in August, the public advisory followed on October 13. The person who reported the flaw is attributed in the advisory, no active exploit has been reported to date.
This looks like a textbook case of a seemingly small validation oversight turning into a security disaster. It spotlights how a missing check in authentication flows—especially in SDKs used across multiple tenants—can lead to major exposure of secrets. This is a reminder that versioning isn’t always linear: even after a fix, regressions (like those seen in the 0.53-0.55 line) can reintroduce vulnerabilities. Going forward, dev teams should pay close attention not just to when vulnerabilities are patched, but whether fixes persist correctly across new modules or shared code paths.
