SAP Patches Maximum-Severity OAuth2 SSRF Flaw in Python Cloud SDK

Germany's SAP has shipped its October security update, patching 20 vulnerabilities across its product range. The most severe is a flaw in the SAP Cloud SDK for Python — the official toolkit for building AI agents and Python applications on the SAP Business Technology Platform (BTP).

Credential theft via a controlled parameter

Tracked as CVE-2026-89111, the vulnerability carries the maximum severity score and can be exploited remotely by unprivileged attackers. It stems from the OAuth2 flow in multi-tenant BTP applications: an attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to a server of their choosing, exfiltrating the client's credentials in a server-side request forgery (SSRF) attack.

For customers unable to patch immediately, SAP suggests a temporary workaround: validate tenant_subdomain values against an allowlist of registered tenant subdomains before passing them to any SDK call.

More critical bugs

The same release addresses CVE-2026-89110, a critical broken-access-control flaw in SAP NetWeaver Visual Composer that lets a remote attacker with limited privileges fully compromise a system. A further critical issue, CVE-2026-89108 in SAP Manufacturing Integration and Intelligence, allows an administrator-level user to seize control of the underlying system by provisioning an elevated-privilege account on the underlying Java app.

A recurring pattern

SAP has patched several maximum-severity flaws in recent months. In August it fixed CVE-2026-58231 in the Commerce Cloud e-commerce platform — which threat-intel firm Defused flagged as actively exploited just days later. In September it closed CVE-2026-44756, a Kernel memory-corruption flaw dubbed OVERPASS by Onapsis researchers, who estimated that more than 10,000 internet-facing SAP systems ran the vulnerable component.

Since November 2021, the U.S. agency CISA has added 14 SAP flaws to its catalog of actively exploited vulnerabilities, three of which were abused in ransomware attacks. SAP serves 99 of the world's 100 largest companies and reported revenues exceeding €36 billion in fiscal 2025.

Source: Bleeping Computer