SAP rated a Python SDK flaw maximum severity. One field could redirect OAuth logins.
By Lior AharonovFounder, 7IT Solutions ·
SAP's October 2026 updates fixed CVE-2026-89111 in the SAP Cloud SDK for Python, rated maximum severity per BleepingComputer, which reported it on 13 October. In multi-tenant apps on SAP BTP, an attacker who controls the tenant_subdomain value can redirect OAuth2 token requests to their own server and capture client credentials. No privileges are needed, and the article reports no exploitation.
If your app lets a customer's subdomain flow into an SDK call, that value becomes a route to your OAuth client secret. One leaked secret can open every tenant behind it. Check where that value comes from.
If you build multi-tenant apps on SAP BTP with this SDK, update to the October 2026 release. Until then, check tenant_subdomain against an allowlist of registered tenants before any SDK call.
Never trust a value because it arrived inside your own app. A subdomain is user input.
Lior Aharonov · my takeSources
- BleepingComputer: SAP warns of maximum severity OAuth2 SSRF security flaw bleepingcomputer.com
Researched with AI tools; every fact is checked against the linked sources.