CriticalCVE
SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
The Hacker News·Source published ·1 min read
What happened?
A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP's official Python client for BTP services. An attacker must be able to control the tenant subdomain,
Key details
- The vulnerability affects multi-tenant applications on SAP BTP that use the SDK and pass a tenant subdomain.
- The flaw is tracked as CVE-2026-89111 with a CVSS score of 10.0 according to SAP.
- Version 0.45.2 added a validation check that rejects tenant subdomains containing URL delimiters.
- Six releases from 0.53.0 to 0.55.0 regressed and skipped the check for Destination service calls.
Affected
- SAP Cloud SDK for Python versions below 0.45.2, including 0.36.1 and 0.36.2.
- SAP Cloud SDK for Python version 0.55.0 for Document Management Service calls.
Fixes and mitigations
- Applications unable to upgrade can validate tenant subdomains against a list of registered tenants before passing to the SDK.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.