Read the docs
TI-2026-71495 Aliases CVE-2026-89111GHSA-m3j7-wp2j-mhc3

Server-side request forgery in SAP Cloud SDK for Python OAuth2

Priority MEDIUM 49CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The SAP Cloud SDK for Python (sap-cloud-sdk) is affected before 0.45.2 and from 0.53.0 before 0.55.1. Missing validation of the tenant subdomain (CWE-918) lets an attacker who controls the tenant_subdomain parameter redirect OAuth2 token requests to a server they control. This exfiltrates client credentials in multi-tenant BTP applications, and the attacker needs no privileges or user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. This vulnerability was originally fixed in 0.45.2. It was reintroduced in 0.53.0 when the HTTP client was refactored into a shared core module, and the tenant subdomain validation was not carried over to the new location. The validation was restored in 0.55.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00372 31st percentileScored 2026-11-07
Fix Fixed SAP Cloud (SAP_SE): 0.55.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Cloudsap-cloud-sdk < 0.45.2; >=0.53.0 to before 0.55.10.55.1Patch availableCNA
  • SAP Cloud VendorSAP Affected sap-cloud-sdk < 0.45.2; >=0.53.0 to before 0.55.1 Fixed in 0.55.1 Patch available CNA

Remediation

Update SAP Cloud SDK for Python to version 0.55.1, which restores the tenant subdomain validation.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA SAP Cloud (SAP_SE) Fixed in 0.55.1

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-89111
  2. 2026-10-13 Alias added: GHSA-m3j7-wp2j-mhc3
  3. 2026-10-15 CISA SSVC decision points changed
  4. 2026-10-30 Fix available: SAP_SE/SAP [email protected] · CNA

References

Other 2

  • TI-2025-22522 Missing Authorization check in SAP NetWeaver (Visual Composer development server) KEVCVSS 3.1CRITICAL 10.0
  • TI-2022-06811 SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP… KEVCVSS 3.1CRITICAL 10.0
  • TI-2021-15842 Path traversal in SAP NetWeaver KEVCVSS 3.1CRITICAL 9.9
  • TI-2020-05139 Missing authentication in SAP NetWeaver AS JAVA KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-05063 Missing authentication in SAP Solution Manager KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-00284 Deserialization of untrusted data in SAP Commerce Cloud KEVCVSS 3.1CRITICAL 9.8
See all 1967 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences