CVE-2026-89111 carries a CVSS score of 10.0 and can allow an application using SAP's Cloud SDK for Python to send its OAuth2 client ID and client secret to a server an attacker controls, SAP said in a security advisory on October 13.
How the SDK flaw exfiltrates OAuth2 client credentials
The SDK requests access tokens on behalf of an application by taking a token URL from the application's configuration and replacing part of that URL with the tenant subdomain the application passes to the SDK. Releases that lack a validation check accept whatever tenant subdomain they are given; the SDK then sends the application's client ID and client secret to the resulting URL to request the token. If an attacker controls the tenant subdomain, they can point that token request at an attacker-controlled endpoint and receive the client credentials, SAP explains. SAP labels the vulnerability a server-side request forgery (SSRF).
Which releases are affected and how the defect evolved
SAP issued a fix in version 0.45.2, released on August 21, 2026, which added a validation that rejects tenant subdomains that are not a simple name. That check accepts only a single name composed of letters, digits and hyphens, up to 63 characters long; any other value causes the SDK to raise an error and stop the request.
However, code changes subsequently moved some authentication logic into shared modules without the validation. Specifically, versions 0.53.0 through 0.55.0, published between September 10 and September 18, 2026, skipped the check when an application called the SDK's Destination service module because the module was moved onto new shared code for requesting tokens that did not include the validation. Version 0.55.1, released on September 18, added the check back into that shared code; its release notes state the update "now raises ValueError immediately instead of silently routing credentials to an attacker-controlled endpoint."
Separately, the older 0.36 line also lacks the check: two releases on that line, 0.36.1 and 0.36.2 (published September 4 and September 10), failed the tests SAP added with 0.55.1. SAP's advisory lists the affected range as versions below 0.45.2; as of October 13 it lists no version above 0.45.2 as affected. On October 13, version 0.58.4 was the newest release on PyPI and versions 0.45.2–0.52.2 and 0.55.1–0.58.4 contain the check; upgrading within the 0.36 line does not add it and none of that line's three releases contains it.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogSAP advisory, The Hacker News verification, and attribution
SAP published the security advisory on October 13, 2026, and tracked the issue as CVE-2026-89111 with a CVSS score of 10.0. The advisory says the August fix covered three modules: Agent Gateway, Destination and Document Management Service, and recommends comparing tenant subdomains with a list of registered tenants before passing them to the SDK for applications that cannot upgrade immediately.
The Hacker News ran SAP's own tests on October 13 against the source code for every release from 0.45.1 to 0.58.4 and the three 0.36 releases. The six releases that lacked the validation failed 9 of the 11 tests SAP added with version 0.55.1. Version 0.55.1 and the 11 releases after it passed all 11 tests, The Hacker News reported. The advisory credits a GitHub user named SunandM with reporting the flaw and does not report any attacks.
What this means for technologists, affected enterprises, and adversaries
- Technologists and security teams: Audit whether your application passes a tenant subdomain to the SDK and which SDK release you run. SAP says versions 0.45.2–0.52.2 and 0.55.1–0.58.4 include the validation; applications that cannot upgrade yet should compare tenant subdomains to their registered-tenant list before calling the SDK.
- Affected enterprises and procurement teams: Confirm whether deployed applications are multi-tenant and whether they use the SDK to construct token URLs from tenant subdomains; if they ran a release without the check, note that SAP's advisory does not say whether client credentials should be rotated.
- Adversaries and threat actors: The vulnerability requires control of a tenant subdomain; if an attacker can provide a subdomain containing URL delimiters to a vulnerable release, the SDK may send OAuth2 client credentials to an endpoint the attacker controls.
The flaw was present in the SDK from its first PyPI release on March 16, 2026; SAP fixed the behavior in August but reported the issue publicly in October. The advisory and subsequent code reviews show the importance of consistent validation in shared authentication code: when the token-request logic moved, the check briefly disappeared and credentials could have been routed to unintended endpoints. SAP's advisory and The Hacker News verification together document which versions include the check and which do not, leaving operators to decide whether to upgrade, add pre-checks of tenant subdomains, or take other remediation steps.
