CRITICAL 10.0 NVD
CVE-2026-89111
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parame
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.
References
- https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHS
- https://url.sap/sapsecuritypatchday
This critical severity vulnerability with a CVSS score of 10.0 was published on 2026-10-13 via NVD.
Risk Timeline
CVE Disclosed2026-10-13 · -1 days ago
Remediation Resources
vulnfeed aggregates 11052 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.