SAP Cloud SDK for Python — Critical OAuth2 Credential Exfiltration Flaw (CVE-2026-89111)

Publication date: October 13, 2026
Category: Vulnerability / Cloud Security

Introduction

SAP has issued a security advisory detailing a critical vulnerability affecting its Cloud SDK for Python, tracked officially as CVE-2026-89111. The flaw compromises multi-tenant applications deployed on the SAP Business Technology Platform (BTP) that utilize the SDK. By manipulating the tenant subdomain parameter, an unauthorized attacker can redirect OAuth2 token requests to a remote server under their control, leading to the direct exfiltration of client credentials. The security issue was initially reported by GitHub user SunandM, triggering an extensive audit of PyPI package releases.

What is CVE-2026-89111? (General Analysis)

The affected component is SAP’s official Python client SDK designed to interact with BTP services. In multi-tenant environments, the SDK manages authentication by handling sensitive client credentials (Client ID and Client Secret). When an application requests an access token, the SDK dynamically constructs the target URL by embedding the supplied tenant subdomain.

If input validation is bypassed, an attacker can inject URL delimiters into the subdomain parameter to arbitrarily redirect the authentication endpoint. This condition is categorized technically as a Server-Side Request Forgery (SSRF) vulnerability.

Official facts confirmed by NVD:

  • CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
  • Base Score: 10.0 (CRITICAL)
  • Official CWE: CWE-918 (Server-Side Request Forgery - SSRF)
  • CISA KEV: Not listed in the catalog as of issuance date.

How Does It Work? (Technical Analysis)

The exploitation mechanism and underlying software flaw operate through the following stages:

  • Exploit Entry Flow: The attack vector initiates when a multi-tenant application accepts unauthenticated user input and passes it directly to the SDK as the tenant_subdomain parameter.
  • Input Sanitization Bypass: Specific SDK releases introduced regressions where strict string validation (which mandates a single name consisting exclusively of letters, digits, and hyphens up to 63 characters long) was omitted. Specifically, calls targeting modules such as the Destination service failed to enforce this check, permitting URL delimiters and special characters.
  • OAuth2 Credential Exfiltration: By tampering with the base authentication URL via the malicious subdomain, the SDK inadvertently forwards the application’s Client ID and Client Secret directly to an attacker-controlled endpoint over HTTPS, compromising the application’s cloud identity.

“An attacker who controls the tenant subdomain can point that request at their own server, causing client credentials to be exfiltrated.”

Affected Systems / Environments

The vulnerability impacts multiple versions of the sap-cloud-sdk package in Python, varying by the invoked service module:

CVE Category (CWE) Impact CVSS Vector (summarized)
CVE-2026-89111 CWE-918 High Confidentiality, High Integrity 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
  • Mainline / Versions below 0.45.2: Entirely lack subdomain validation, including legacy branch versions 0.36.1 and 0.36.2 published after the initial August patch.
  • Range 0.45.2 to 0.52.2: Properly implement the validation check.
  • Range 0.53.0 to 0.55.0: Exhibit missing validation checks when invoking the Destination and Document Management Service modules.
  • Version 0.55.1 and newer: Enforce the strict check, immediately raising a ValueError upon encountering malformed subdomains.

Mitigation and Detection

Remediation

  • Immediate Upgrade: Upgrade the package to the latest available release on PyPI (0.58.4 or higher), ensuring vulnerable intermediate branches are bypassed. Versions 0.45.2 through 0.52.2 and 0.55.1 onwards contain the proper fix.
  • Compensatory Controls: For applications unable to upgrade immediately, developers must implement manual input validation, comparing each tenant_subdomain against a strict whitelist of registered tenants before passing it to the SDK.
  • Credential Rotation: Security teams should audit access logs and proactively rotate OAuth2 credentials (Client ID and Client Secret) for any applications that previously executed unpatched SDK versions.

Detection

  • Monitor outbound network traffic for unexpected HTTPS connections originating from backend workloads toward unauthorized external domains or endpoints diverging from official SAP BTP identity service domains.
  • Inspect application logs for unhandled exceptions or pattern matching indicative of delimiter injection attempts within tenant routing parameters.

Wrapping Up

The disclosure of CVE-2026-89111 with a perfect CVSS score of 10.0 underscores the complexity of maintaining stringent security controls throughout the development lifecycle of cloud-native SDKs. The temporary omission of validation checks in specific modules highlights the critical need for comprehensive automated regression testing to prevent the reintroduction of severe SSRF flaws that compromise trust chains in multi-tenant environments.

References