Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-89111

OAuth2 SSRF vulnerability in SAP Cloud SDK for Python

CVSS 3.1 10.0 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-89111

Published

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. This vulnerability was originally fixed in 0.45.2. It was reintroduced in 0.53.0 when the HTTP client was refactored into a shared core module, and the tenant subdomain validation was not carried over to the new location. The validation was restored in 0.55.1.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-89111

Published

SAP Cloud

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "SAP_SE",
                    "product": "SAP Cloud",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "sap-cloud-sdk < 0.45.2"
                        },
                        {
                            "status": "affected",
                            "version": ">=0.53.0",
                            "lessThan": "0.55.1",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON