GoKawiilSAP patches critical SSRF flaw in Cloud SDK for Python, 19 other bugs
SAP's October 2026 security update fixes 20 vulnerabilities, including a maximum-severity OAuth2 SSRF flaw (CVE-2026-89111) in the Cloud SDK for Python used to build AI agents and apps on SAP BTP. The bug lets unauthenticated remote attackers manipulate the tenant_subdomain parameter to redirect OAuth2 token requests and steal client credentials. SAP also fixed two other critical issues: a broken access control flaw in NetWeaver Visual Composer and a privilege-escalation bug in Manufacturing Integration and Intelligence.
GoKawiil's interpretation of the reporting above, not reported fact.
The SDK flaw could let attackers compromise multi-tenant cloud applications by stealing OAuth2 credentials without needing any prior access, which is especially risky for enterprise systems built on SAP BTP. SAP's recommended stopgap—allowlisting tenant subdomains—suggests the company expects some customers won't patch immediately. Past maximum-severity SAP bugs, such as one in Commerce Cloud fixed in August, were exploited in the wild within days, according to threat intelligence firm Defused, which raises the stakes for quick patching here too.
- SAP's October 2026 update addresses 20 vulnerabilities across multiple products.
- CVE-2026-89111, a maximum-severity SSRF flaw in the Cloud SDK for Python, allows credential theft via OAuth2 token redirection.
- Two other critical flaws were fixed in NetWeaver Visual Composer and Manufacturing Integration and Intelligence.
Source: bleepingcomputer.com, 2026-10-13
Published there as: “SAP warns of maximum severity OAuth2 SSRF security flaw”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.