SAP Discloses Maximum Severity CVSS 10 Flaw in Python Cloud SDK
Vulnerability allows OAuth2 credential theft via server-side request forgery in multi-tenant BTP setups.
1Critical Vulnerability Disclosed by SAP
SAP published a security advisory detailing a maximum severity flaw tracked as CVE-2026-89111 with a CVSS score of 10.0. The vulnerability impacts multi-tenant applications on the SAP Business Technology Platform running the official Cloud SDK for Python, allowing attackers to hijack core authentication credentials.
2OAuth2 Token Theft Mechanism
When multi-tenant apps process requests, the SDK modifies token endpoints using tenant subdomains. In vulnerable versions, manipulating the subdomain forces the SDK to transmit OAuth2 client IDs and secrets directly to an attacker-controlled endpoint via server-side request forgery rather than the legitimate authorization server.
3Initial Patch and Regression Issues
SAP originally released version 0.45.2 on August 21 to validate subdomains. However, refactoring the Destination service module in versions 0.53.0 through 0.55.0 inadvertently removed these checks. These releases failed nine out of eleven test cases until version 0.55.1 reinstated the fix on September 18.
4Legacy Branches Left Unprotected
Older releases on the 0.36 line remain unprotected. Versions 0.36.1 and 0.36.2 were published in September after the initial August fix but failed validation suites. Upgrading within the 0.36 line provides no resolution because none of its releases implement the mandatory input filtering checks.
5Input Validation Specifications
The implemented sanitization restricts tenant subdomains to simple alphanumeric strings and hyphens with a strict 63-character limit. Any input containing URL delimiters triggers an immediate ValueError exception, preventing malicious URL manipulation across the Agent Gateway, Destination, and Document Management Service modules.
6Extended Flaw Timeline and Origins
The vulnerable URL construction logic existed in the SDK since its initial PyPI release on March 16. SAP first categorized the August fix as a routine bug without mentioning security implications, publishing the formal advisory 53 days later following a disclosure credit to GitHub user SunandM.
7Recommended Workarounds and Mitigation
Organizations unable to immediately upgrade to version 0.55.1 or newer must implement application-side validation. SAP advises verifying every tenant subdomain against an internal allowlist of registered tenants before invoking SDK methods, mitigating external parameter manipulation until package updates can be applied across deployments.
8Credential Rotation and Scope Assessment
While SAP reported no active exploitation, the advisory does not clarify whether exposed applications need credential rotation. Security teams must audit historical logs to identify potential unauthorized credential transmissions and evaluate the privilege scope tied to each application's OAuth2 client credentials.
Original article: The Hacker News — SAP Discloses Maximum Severity CVSS 10 Flaw in Python Cloud SDK