GoKawiilSAP patches critical SSRF flaw in Cloud SDK for Python, 19 other bugs
SAP's October 2026 security update fixes 20 vulnerabilities, including a maximum-severity OAuth2 SSRF flaw (CVE-2026-89111) in the Cloud SDK for Python used to build AI agents and apps on SAP BTP. The bug lets unauthenticated remote attackers manipulate the tenant_subdomain parameter to redirect OAuth2 token requests and steal client credentials. SAP also fixed two other critical issues: a broken access control flaw in NetWeaver Visual Composer and a privilege-escalation bug in Manufacturing Integration and Intelligence.