SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
Read original article ↗AI Summary
SAP disclosed a critical CVSS 10.0 vulnerability, CVE-2026-89111, in its Cloud SDK for Python that allows server-side request forgery (SSRF), enabling attackers to steal OAuth2 client credentials from multi-tenant applications on SAP Business Technology Platform (BTP). The flaw occurs when an attacker controls the tenant subdomain passed to the SDK, which can result in the SDK sending the application's client ID and client secret to an attacker-controlled server. The vulnerability was introduced in version 0.45.2 and reappeared in versions 0.53.0 through 0.55.0 due to a missing validation check in shared token request code, with the fix reintroduced in version 0.55.1. Older versions in the 0.36 line, including 0.36.1 and 0.36.2, also lack the necessary validation.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.