CVE-2026-89111

Think of this like a mail-forwarding scam: your SAP application sends a 'login request' to confirm who it's talking to, but an attacker can quietly redirect that request to their own mailbox instead of SAP's real server. The confidential login credentials get delivered straight into the attacker's hands, and they can then use them to access connected systems as if they were you.

This matters to you if your business runs a multi-tenant application built on SAP Cloud SDK for Python on SAP's Business Technology Platform (BTP). It does not require any login or user action from a victim — an attacker just needs to control a specific subdomain-style input your application accepts, so exposure depends on whether that input is reachable and unvalidated in your setup.

This is rated critical severity because an attacker needs no credentials or user interaction to steal OAuth2 secrets, and there is currently no official patch available to close the hole. While no confirmed real-world exploitation or public exploit code has been reported yet, the combination of maximum severity, no authentication barrier, and absence of a fix means you should treat this as urgent and apply mitigations immediately rather than wait.

Confirm exposure by auditing all applications using SAP Cloud SDK for Python, specifically multi-tenant BTP services that accept a tenant_subdomain or similar tenant-identifying parameter from untrusted input. No fixed version is currently published by SAP for this CVE — monitor SAP's security patch day announcements and support portal for an advisory. Until a patch ships, implement an allow-list or strict format/domain validation on the tenant_subdomain value before it is used to construct OAuth2 token endpoint URLs, and consider network egress controls (outbound allow-listing) from the application tier to prevent requests reaching arbitrary external hosts. Rotate any OAuth2 client credentials used by affected tenants as a precaution. There is no CISA KEV listing and no CISA-mandated remediation date at this time. Monitor SAP advisories, your WAF/API gateway logs for anomalous tenant_subdomain values, and outbound connection logs for unexpected destinations from the OAuth2 token exchange flow.

CVSS 3.1 score 10.0 (Critical): AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N — network-exploitable, low complexity, no privileges or user interaction required, scope change with high confidentiality and integrity impact, no availability impact. Weakness: CWE-918 (Server-Side Request Forgery), triggered via attacker control of the tenant_subdomain parameter in multi-tenant SAP BTP apps, redirecting OAuth2 token requests. EPSS places predicted near-term exploitation likelihood in the low range with a flat trend, and the vulnerability is not in CISA KEV; no public exploit code or confirmed in-the-wild exploitation has been reported. Press coverage has been sustained but is roundup-style reporting rather than evidence of active attacks. No patch is currently available, which elevates risk despite the lack of confirmed exploitation.