SAP has disclosed a critical vulnerability CVE-2026-89111 with the maximum score of CVSS 10.0 in its Cloud SDK for Python, the official Python client for SAP Business Technology Platform (BTP) services. According to the security advisory, the vulnerability allows an attacker who controls the tenant_subdomain parameter to redirect OAuth2 requests to a server they control and intercept client credentials (client ID and client secret) of multitenant applications. Versions of the sap-cloud-sdk package below 0.45.2 are affected. A fix is available — update to version 0.45.2 or higher.
Mechanism of the vulnerability
The vulnerability is classified as CWE-918 (server-side request forgery, SSRF). When a multitenant application on SAP BTP passes a tenant_subdomain value to the SDK, the SDK substitutes it into the URL used to obtain an OAuth2 token. In vulnerable versions, the SDK accepted arbitrary values without validation — including strings with URL delimiters. An attacker able to control this parameter could craft a value that redirects the request to their own server, where the SDK would send the application’s client credentials.
The fix in version 0.45.2 added validation of tenant_subdomain according to RFC 1123 rules for DNS labels: only letters, digits and hyphens with a length of up to 63 characters are allowed. Invalid values now cause a ValueError. The check was added to three modules: Agent Gateway, Destination and Document Management Service.
Affected versions and patch nuances
The official SAP advisory lists all versions below 0.45.2 as affected, and version 0.45.2 as fixed. However, according to The Hacker News, which tested the source code using SAP’s own tests, the situation is more complex. Versions from 0.53.0 to 0.55.0 reportedly do not contain the check in the Destination module — during a refactoring in version 0.53.0, the token handling code was moved to a new shared component, XsuaaAuthProvider, and the validation was not included there. According to the same report, these versions failed 9 out of 11 validation tests that SAP added in version 0.55.1.
It is also reported that versions 0.36.1 and 0.36.2, released after the August fix, also lack the check. Important: as of publication time, the official SAP advisory does not list versions above 0.45.2 as affected, and the question of whether CVE-2026-89111 applies to these later releases remains open.
Thus, based on the available information, the validation is present in:
- Versions from 0.45.2 to 0.52.2
- Versions from 0.55.1 to 0.58.4 (the latest release at the time of disclosure)
None of the three versions in the 0.36 line contain validation, and updating within this line does not resolve the issue.
Impact assessment
The vulnerability does not affect all SDK deployments, but only multitenant applications on SAP BTP that pass a tenant_subdomain value into the SDK — specifically via the Destination, Agent Gateway and Document Management Service modules. Applications that do not use these paths are not vulnerable to this issue.
The impact of exploitation depends on the privileges of the compromised client credentials. The SAP advisory does not specify possible scenarios, but interception of OAuth2 credentials could potentially open access to all resources for which the application client is authorized. Active exploitation of the vulnerability has not been confirmed at this time; the CVE is not listed in the CISA KEV catalog.
SAP has repeatedly faced critical vulnerabilities in its cloud products — earlier we covered a CVSS 10.0 vulnerability in Commerce Cloud.
Recommendations
- Update the SDK to version 0.55.1 or later (0.58.4 is recommended). Versions 0.45.2–0.52.2 also contain the validation, but do not cover the path through XsuaaAuthProvider, which was introduced in 0.53.0.
- If updating is not possible, SAP recommends validating tenant_subdomain against a list of registered tenants before passing the value to the SDK.
- Check the version in use: if the application runs on versions 0.53.0–0.55.0 and uses the Destination module, updating is critical even though the official advisory does not formally list these versions as affected.
- Assess whether credential rotation is necessary: the SAP advisory does not specify whether application client credentials used with vulnerable versions should be replaced. For applications that process external tenant data, rotating credentials is a reasonable precaution.
The vulnerability has been present in the SDK since the first release on PyPI in March, was quietly fixed in August as a “Bug Fix” without mentioning security, and the advisory appeared only 53 days later. Organizations using multitenant applications on SAP BTP with Cloud SDK for Python should immediately check the SDK version and update it to 0.55.1 or higher, and if updating is not possible, implement tenant_subdomain validation against a whitelist of registered tenants.
