SAP has disclosed a vulnerability in its Cloud SDK for Python, tracked as CVE-2026-89111, affecting multi-tenant applications on the SAP Business Technology Platform.
The flaw could transmit OAuth2 client credentials to an external server if an attacker controls the tenant subdomain.
Affected versions include 0.53.0 through 0.55.0 and 0.36.1 through 0.36.2.
SAP addressed the issue in version 0.55.1 by restoring subdomain validation.
The issue affects multi-client applications on SAP's Business Technology Platform that leverage the Python toolkit. According to the advisory issued by the company on October 13, 2026, the vulnerability was rated as the maximum severity.
To exploit the issue, someone would have to be able to verify the client's address. In that case, the tool could be tricked into sending the application's login credentials to the wrong destination.
SAP had added a security check in August with version 0.45.2 that rejected invalid addresses. However, versions 0.53.0 through 0.55.0 released in September omitted this check in some functions, and a similar issue was also found in earlier versions of the 0.36 series.
The company released version 0.55.1 on September 18, which reinstates and properly enforces the necessary security check. So far, there are no reports of actual attacks exploiting the issue, while the report was made by a GitHub user named SunandM.
Top comments (0)