What SAP fixed

The risky value is the tenant subdomain

SAP’s 13 October security release lists CVE-2026-89111 as a critical OAuth2 server-side request forgery flaw in the Cloud SDK for Python. Versions of sap-cloud-sdk before 0.45.2 are affected. The issue concerns multi-tenant BTP applications that let an attacker influence the tenant_subdomain value passed to the SDK.

That value can determine where an OAuth2 token request goes. If an untrusted value redirects the request to an attacker-controlled server, client credentials can leave the application with it. This is a credential-exposure risk at the application’s trust boundary, not a report that every SAP installation has been compromised.

Scope matters

An organisation needs to check whether it uses the affected Python SDK in a multi-tenant flow and whether untrusted input can reach the tenant-subdomain parameter. The CVSS 10.0 rating is a prioritisation signal, not proof of exploitation in its own environment.

Why defenders should care

A token request may carry more than a URL

Teams often watch for secrets exposed in logs or source code. Here the concern is a legitimate authentication flow sending a request to the wrong destination. A successful leak could give an attacker application client credentials, so an SDK update may need to be paired with a credential-exposure assessment if the vulnerable path was reachable.

SAP’s bulletin also includes other critical issues in different products. They deserve their own product-specific triage. Do not treat the Python SDK flaw as interchangeable with the NetWeaver or S/4HANA entries in the same patch release.

Defender workflow

Find the dependency, then inspect the boundary

  1. 1

    Locate the affected application. Search Python dependency manifests, lockfiles and deployed images for sap-cloud-sdk below 0.45.2. Identify the service owner and whether the application handles multiple tenants.

  2. 2

    Update and test the authentication path. Move to version 0.45.2 or later, follow SAP’s advisory, and test tenant resolution and token acquisition in a controlled environment before rollout.

  3. 3

    Constrain the tenant value. Pass only registered tenant subdomains into SDK calls. Do not treat a caller-supplied hostname as a trusted OAuth2 destination.

  4. 4

    Assess possible credential exposure. Where an untrusted tenant value reached the affected flow, review outbound destinations and authentication logs. Rotate client credentials when evidence or uncertainty makes exposure plausible.

Defender note

Close the ticket with evidence

A useful remediation record names the deployed SDK version, the tenant-subdomain validation rule, the applications that were checked, and the result of the exposure review. That is stronger than a ticket closed solely because a package scanner stopped flagging the CVE.

As of this report, the cited vendor material establishes a fix and an impact path; it does not establish active exploitation. We will update that assessment if primary-source evidence changes.