External risk intelligence

SAP Cloud SDK Python OAuth2 SSRF Exfiltrates Client Credentials.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-89111

The vulnerability affects SAP Cloud SDK for Python within multi-tenant BTP applications. These applications are typically designed as cloud-based web services or APIs that are internet-facing to support multi-tenant access, making the affected authentication and token handling components a standard part of the exposed application surface.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The SAP Cloud SDK for Python has a critical vulnerability that could allow attackers to steal client credentials by redirecting authentication requests. This affects multi-tenant business applications built using the SDK.

A flaw allows attackers to steal application credentials.
It impacts how cloud applications handle authentication.
Confirm relevance and exposure for multi-tenant applications.

Attack Path

How an attacker could exploit the issue

An attacker with the ability to influence application configuration could exploit this by controlling a specific subdomain parameter. This allows them to redirect authentication requests, leading to the exfiltration of sensitive client credentials. The vulnerability is present in the OAuth2 token request handling within SAP Cloud SDK for Python, potentially impacting multi-tenant applications.

No prior authentication required.
Redirect OAuth2 token requests.
Exfiltrate client credentials.

Live Threat

Current exploitation, exposure, and threat context

A Server-Side Request Forgery (SSRF) vulnerability in the SAP Cloud SDK for Python could allow an attacker to redirect OAuth2 token requests. When supported by the advisory's conditions, this could lead to the exfiltration of client credentials.

Client credentials could be at risk.
Redirect OAuth2 token requests to attacker servers.
Client secrets may be exposed.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the SAP Cloud SDK for Python, impacting multi-tenant BTP applications, requires a coordinated response. Application owners are likely responsible for the affected code, while platform and security teams need to assess the broader impact and potential for exploit. The immediate first step is to identify all instances of the SAP Cloud SDK for Python within your environment, determine their reachability and business criticality, and confirm the accountable owner for each instance to prioritize remediation efforts.

Application owners should address the vulnerability.
Verify application reachability and business criticality.
Plan coordinated remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the SAP Cloud SDK for Python used for?

The SAP Cloud SDK for Python is a collection of libraries that helps developers build and integrate business applications on the SAP Business Technology Platform. It simplifies common cloud development tasks, such as securely managing authentication, connecting to various SAP services, and handling multi-tenant architecture where a single application instance serves multiple distinct customers.

How does CVE-2026-89111 work?

This vulnerability is a Server-Side Request Forgery, classified as CWE-918. It occurs when the SDK improperly handles the 'tenant_subdomain' parameter during OAuth2 authentication. By manipulating this input, an attacker can force the application to send sensitive token requests to a malicious server instead of the legitimate authorization service, potentially exposing the application's client credentials.

What triggers this SSRF vulnerability?

An attacker triggers the flaw by controlling the 'tenant_subdomain' parameter used during the OAuth2 flow in a multi-tenant BTP application. The issue does not stem from general web traffic or routine user activity, but specifically from the application's logic that processes these subdomain parameters to route authentication requests.

Is my application at risk for CVE-2026-89111?

According to Halo Surface Signal, applications built on the SAP Cloud SDK for Python are likely at risk if they are multi-tenant web services or APIs. Because these applications are designed to be accessible to various tenants over the internet, the authentication components affected by this vulnerability form part of the standard, exposed surface area of the software.

How should I respond to this threat?

Begin by creating an inventory of all software using the SAP Cloud SDK for Python within your environment. Once identified, evaluate which applications are multi-tenant and currently active. Coordinate with application owners to confirm the risk, assess business criticality, and prepare to apply security updates provided by the vendor to remediate the affected OAuth2 request handling.

References

github.com/SAP/cloud-sdk-python/security/advisories/GHSA-4mv3-jx…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.