Overview
- SAP published a security advisory on October 13 that tracks the bug as CVE-2026-89111 with a CVSS score of 10.0 and includes the issue in its October 2026 security updates.
- The vulnerability is an SSRF in the Cloud SDK for Python that uses a supplied tenant_subdomain to build a token URL and can send the application's client ID and client secret to that URL.
- SAP added a strict tenant_subdomain check in release 0.45.2 on August 21, but independent tests found regressions in later release lines where the check was omitted in some code paths, notably 0.53.0–0.55.0 and two 0.36.x releases.
- Customers are advised to upgrade to releases that include the validation (0.45.2 through 0.52.2 and 0.55.1 onward) or implement an allowlist of known tenant subdomains as a temporary mitigation; SAP credited GitHub user SunandM for reporting the flaw and reported no observed exploitation so far.
- Because SAP SDKs are widely used by large enterprises, administrators should audit multi-tenant BTP apps that passed tenant subdomains to the SDK, update or block unsafe releases, and consider rotating client credentials if they ran vulnerable versions.