SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft

SAP has published an advisory for a maximum-severity flaw, tracked as CVE-2026-89111 with a CVSS score of 10.0, in its Cloud SDK for Python, the official client library used by multi-tenant applications on SAP Business Technology Platform. The bug lets an attacker who controls a tenant's subdomain trick the SDK into sending the application's OAuth2 client ID and secret to a server they operate, a classic server-side request forgery issue, because the library failed to validate that the subdomain was a simple alphanumeric name before building the token-request URL. SAP says version 0.45.2, shipped on August 21, fixes the flaw, but research by The Hacker News found that six subsequent releases (0.53.0 through 0.55.0) reintroduced the missing check for calls through the Destination service module, and that two 0.36-series builds released after the fix never had the protection at all; the real fix for those paths only landed with 0.55.1. The advisory currently lists no version beyond 0.45.2 as vulnerable and gives no guidance on whether affected credentials should be rotated, so administrators running any release outside 0.45.2–0.52.2 or 0.55.1–0.58.4 should upgrade immediately or validate tenant subdomains against a known allow-list before passing them to the SDK.