SAP warns of maximum severity OAuth2 SSRF security flaw

SAP's October 2026 security update rolls out fixes for 20 vulnerabilities, headlined by a maximum-severity flaw in the Cloud SDK for Python used to build AI agents and apps on SAP's Business Technology Platform. Tracked as CVE-2026-89111, the bug allows an unauthenticated remote attacker who controls the tenant_subdomain parameter to redirect OAuth2 token requests to a server they control, exfiltrating client credentials from multi-tenant BTP applications. Organizations unable to apply the patch immediately are advised to restrict tenant_subdomain values to a known allowlist as a temporary workaround. The same update batch also closes a critical access-control bug in SAP NetWeaver Visual Composer (CVE-2026-89110) and a critical privilege-escalation issue in SAP Manufacturing Integration and Intelligence (CVE-2026-89108), continuing a string of severe SAP flaws patched in recent months, including CVE-2026-58231 in Commerce Cloud and the OVERPASS kernel bug CVE-2026-44756.