SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft

SAP disclosed a critical security flaw in its Cloud SDK for Python, which could potentially expose an application's OAuth2 client credentials to a malicious server. This vulnerability affects multi-tenant applications on the SAP Business Technology Platform (BTP) that utilize the SDK. The flaw, identified as CVE-2026-89111, requires an attacker to control the tenant subdomain, which is used by the SDK to identify the tenant for a request. SAP has assigned the flaw a maximum CVSS score of 10.0, indicating its severity. The vulnerability was addressed in version 0.45.2 of the SDK, released on August 21, which introduced a check to reject tenant subdomains that are not simple names. However, subsequent versions, specifically 0.53.0 through 0.55.0, did not consistently apply this check. These versions, published between September 10 and September 18, omitted the check when the SDK's Destination service module was called. The oversight was corrected in version 0.55.1, released on September 18. The flaw arises when an application passes a tenant subdomain to the SDK. The SDK requests an access token for the tenant by modifying the token URL in the application's configuration with the tenant subdomain. Without the check, any value could be used, potentially sending the application's client ID and secret to an attacker-controlled URL. The check implemented in version 0.55.1 ensures that only valid subdomains, consisting of letters, digits, and hyphens up to 63 characters, are accepted. SAP's advisory does not specify whether applications that used versions without the check should replace their client credentials. It emphasizes that the flaw is relevant only when an application passes a tenant subdomain to the SDK. The August fix addressed three modules: Agent Gateway, Destination, and Document Management Service. For applications unable to upgrade, SAP suggests verifying tenant subdomains against a list of registered tenants before passing them to the SDK. The unchecked code was present in the SDK from its initial release on PyPI on March 16. Although the August release notes categorized the fix under "Bug Fixes" without highlighting its security implications, the advisory was issued 53 days later. The flaw was reported by a GitHub user named SunandM, and there have been no reported attacks exploiting this vulnerability. The Hacker News conducted tests on various SDK releases, confirming that the check was absent in six versions, which failed 9 out of 11 tests introduced in version 0.55.1. However, version 0.55.1 and subsequent releases passed all tests. As of October 13, the advisory does not list any versions above 0.45.2 as affected, leaving the status of the six problematic releases unclear. SAP categorizes the flaw as server-side request forgery (SSRF), a vulnerability that allows a server to be manipulated into sending requests to unintended destinations. The potential impact of an attacker obtaining the application's credentials depends on the permissions granted to the application's client. The advisory does not detail specific actions an attacker could undertake with the compromised credentials.