SAP Python Cloud SDK flaw can leak OAuth2 client credentials

SAP has disclosed CVE-2026-89111, a critical vulnerability with a CVSS score of 10.0 in the SAP Cloud SDK for Python. In affected multi-tenant applications on SAP Business Technology Platform (BTP), an attacker able to control the tenant subdomain supplied to the SDK can cause OAuth2 client credentials to be sent to a server they control.

The issue concerns the official Python client used to access BTP services. SAP lists version 0.45.2, released on August 21, as the fix. However, subsequent releases created an important exception: versions 0.53.0 through 0.55.0 did not apply the validation consistently when applications used the Destination service module.

How tenant input can redirect credentials

When an application supplies a tenant subdomain, the SDK requests an access token for that tenant. It takes the token URL from the application configuration, substitutes part of it with the supplied subdomain, and sends the application’s client ID and client secret to the resulting endpoint.

Releases lacking the validation accepted the value provided by the application. SAP says an attacker who controls that tenant subdomain can make the request point to an attacker-controlled server, exposing the credentials used for the token request. SAP classifies the weakness as server-side request forgery, or SSRF.

The added validation permits only a single subdomain label containing letters, digits and hyphens, with a maximum length of 63 characters. Values containing URL delimiters or other invalid characters now fail with a ValueError rather than being used to construct a destination URL.

Release history leaves a version-selection trap

Version 0.45.2 introduced the tenant-subdomain check. Versions 0.45.2 through 0.52.2 contain it, while the shared token-request code introduced in 0.53.0 did not include the check for Destination calls. Version 0.55.1 added the validation to that path on September 18.

Testing reported by The Hacker News found that releases 0.53.0 through 0.55.0 failed nine of the 11 tests SAP added with version 0.55.1. Version 0.55.0 also lacked the check for Document Management Service calls. The 0.55.1 release and the 11 releases following it passed all 11 tests in that testing.

The older 0.36 release line does not provide a safe upgrade path for this issue. Versions 0.36.1 and 0.36.2, published after the August release, also lacked the validation, and all three releases in that line were reported as missing the check.

Actions for SAP BTP application teams

SAP identifies versions 0.45.2 through 0.52.2 and 0.55.1 through 0.58.4 as releases that contain the check; version 0.58.4 was the newest package on PyPI on October 13. The advisory states that the issue matters where an application passes a tenant subdomain to the SDK.

Where an immediate upgrade is not possible, SAP advises applications to compare every tenant subdomain against a list of registered tenants before passing it to the SDK. The advisory does not state whether organisations that ran an unvalidated release should replace their client credentials, nor does it report attacks. In practice, teams should identify affected SDK paths, upgrade to a release with validation, enforce tenant allowlists during transition, and assess the handling of credentials used by exposed applications.