SAP has classified CVE-2026-89111 as Critical, with a CVSS score of 10.0. The flaw affects SAP Cloud SDK for Python versions below 0.45.2 and, according to the project advisory, can put multi-tenant SAP BTP applications at risk when an attacker controls the tenant_subdomain value. Upgrade to version 0.45.2 or later; SAP’s SDK advisory also documents an allowlist workaround for consumer applications.
What is the SAP OAuth2 SSRF vulnerability?
SAP’s October 13, 2026 Security Patch Day bulletin identifies CVE-2026-89111 as a server-side request forgery (SSRF) vulnerability in the SAP Cloud SDK for Python. SAP assigns it Critical priority and a CVSS score of 10.0.
As an Amazon Associate I earn from qualifying purchases.
The project’s security advisory describes the risk in multi-tenant SAP Business Technology Platform (BTP) applications: if an attacker controls the tenant_subdomain parameter, OAuth2 token requests can be redirected to an attacker-controlled server, exposing client credentials. The advisory describes SSRF and credential exposure; it does not describe arbitrary code execution.
Which SAP Cloud SDK for Python versions are affected?
SAP’s bulletin lists versions below 0.45.2 as affected. The repository advisory names 0.45.2 as the patched release.
#1 Best Overall
| SDK version | Status | Action |
|---|---|---|
| Below 0.45.2 | Affected according to SAP’s bulletin | Upgrade |
| 0.45.2 or later | 0.45.2 is the patched release identified by the advisory | Verify the application is using the patched release or later |
How do I fix CVE-2026-89111?
Upgrade the SDK
Move applications using an affected release to SAP Cloud SDK for Python 0.45.2 or later. The advisory says version 0.45.2 validates tenant_subdomain against RFC 1123 DNS label rules before substituting it into a token URL. This is the documented patch.
Use the stated workaround if an immediate upgrade is not possible
For consumer applications, the advisory recommends validating tenant_subdomain against an allowlist of registered tenant subdomains before passing it to an SDK call. Treat this as a workaround, not a replacement for upgrading to the patched release.
Does the flaw affect every SAP or BTP application?
No broad impact across SAP products or all BTP applications is established by the advisories. The named component is SAP Cloud SDK for Python, and the described attack scenario concerns multi-tenant BTP applications where an attacker can control tenant_subdomain. Check whether your application uses the SDK and whether it is on an affected version, then assess how the parameter reaches SDK calls.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
SAP’s bulletin recommends applying patches on priority and directs readers to its Support Portal. The October 13, 2026 bulletin and repository advisory do not provide figures for exploitation in the wild, affected customers, or incidents, so no such prevalence should be inferred from the severity score.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
