CVE-2026-89111

Summary

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability that allows attackers to redirect token requests to attacker-controlled servers, enabling exfiltration of client credentials. This affects multi-tenant BTP applications and represents a critical security flaw.

Exploitability

Exploitation is straightforward with minimal preconditions - an attacker needs only control over the tenant_subdomain parameter to redirect OAuth2 token requests.

Blast radius

If exploited, this vulnerability could lead to widespread credential exfiltration across multiple tenant applications, potentially enabling attackers to impersonate legitimate clients and access sensitive data.

Detection

Monitor for unusual outbound connections from application servers to external IP addresses during OAuth2 token exchange operations, particularly when tenant_subdomain parameter is present in requests.

Prioritized remediation

Upgrade to SAP Cloud SDK for Python version 2.590 or later to address the OAuth2 SSRF vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.