CVE-2026-89111 SAP_SE CVE debrief

Who should care

Defenders responsible for SAP Cloud SDK for Python and multi-tenant BTP applications should assess exposure and implement compensating controls. This includes security teams, IT administrators, and developers who use the SAP Cloud SDK for Python. They should prioritize verifying exposure of SAP Cloud SDK for Python versions less than 0.45.2 and assessing compensating controls for multi-tenant BTP applications.

Why it matters

Defenders should prioritize verifying exposure of SAP Cloud SDK for Python versions less than 0.45.2 and assessing compensating controls for multi-tenant BTP applications to prevent client credentials exfiltration and OAuth2 token request tampering.

• Client credentials exfiltration
• OAuth2 token request tampering
• Multi-tenant BTP application compromise
• Verification of SAP Cloud SDK for Python version

Technical summary

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. The vulnerability has a CVSS score of 10 and a severity of CRITICAL. Technical details include the need to validate user input and implement proper authorization checks. Defenders should prioritize verifying exposure of SAP Cloud SDK for Python versions less than 0.45.2 and assessing compensating controls for multi-tenant BTP applications.

Defensive priority

Defenders should prioritize verifying exposure of SAP Cloud SDK for Python versions less than 0.45.2 and assessing compensating controls for multi-tenant BTP applications.

Recommended defensive actions

• Verify SAP Cloud SDK for Python version is 0.45.2 or later
• Assess exposure of multi-tenant BTP applications
• Implement compensating controls for OAuth2 token requests
• Monitor for suspicious tenant_subdomain activity
• Review SAP security advisories for additional guidance
• Perform vulnerability scanning for affected systems
• Develop incident response plans for potential exploitation

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. Supplemental sources include GitHub and SAP security advisories. The vulnerability affects multi-tenant BTP applications using SAP Cloud SDK for Python versions less than 0.45.2. Defenders should verify exposure and implement compensating controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.