- SAP's Cloud SDK for Python had a maximum-severity flaw, CVE-2026-89111, that could send an app's OAuth2 client credentials to an attacker via the tenant_subdomain value.
- The flaw shows how a customer label placed in a web address becomes a routing instruction, so it needs checking against known tenants.
- Update to SDK 0.45.2, or validate tenant_subdomain against an allowlist, and confirm who owns each app using the SDK.
A customer's name looks harmless. In multi-tenant software, where many customers share one platform, that name often becomes part of a web address. Whoever controls the name can then influence where the software sends its requests. This SAP flaw shows what can happen when that value is not validated.
What SAP disclosed
SAP's advisory says the SAP Cloud SDK for Python has an OAuth2 SSRF vulnerability. It affects multi-tenant applications on SAP Business Technology Platform (BTP). If someone can set the tenant_subdomain value, they can point the app's token request at a machine they own. The app's client credentials then go to that machine.
The flaw is tracked as CVE-2026-89111. BleepingComputer describes it as a maximum-severity bug and says remote attackers need no special privileges to exploit it. The SDK is the toolkit SAP provides for building AI agents and Python applications on BTP, the outlet notes. The fix is in version 0.45.2.
The sources do not say this flaw has been exploited in attacks.
How the flaw works
Two terms matter here. OAuth2 is the common method an app uses to prove who it is and get a short-lived access pass. To do that, the app presents client credentials, which work like an ID and a password for the app itself. SSRF stands for server-side request forgery. It means tricking a server into sending a request to a place the attacker picks.
In this case, the SDK builds the address for the token request by inserting the tenant_subdomain value into a URL. If an attacker can supply that value, the request can end up at the attacker's server. The attacker does not break in. The app delivers its own credentials.
In version 0.45.2, the SDK tests the tenant value against RFC 1123 hostname-segment rules before using it to build the token address. A DNS label is a single name segment, not a full address. SAP also says applications can protect themselves by checking the value against a known list of registered tenant subdomains before any SDK call.
The lesson: a name is part of the address
This shows a pattern in how multi-tenant systems can fail. Teams treat the tenant name as a lookup key, a harmless label. The code treats it as part of a network destination. When those two views differ, a label becomes a routing instruction.
The two defences SAP describes work at different levels. A format check asks whether the value is well formed. An allowlist asks whether it belongs to a customer you actually have. The allowlist is the stronger question. It also lives in the application, so no library update can supply it.
A library fix also reaches an app only when its owners update the dependency and redeploy. In our view, the real risk lies in the inventory. If a team cannot say quickly which services use a given SDK, that gap, not the bug itself, sets how long the exposure lasts.
One flaw among several
The same BleepingComputer report lists other recent SAP fixes. This update round also covers CVE-2026-89110 in NetWeaver Visual Composer, an access-control weakness the outlet calls critical. Per the report, remote attackers with limited privileges could fully compromise vulnerable systems. A further critical bug, CVE-2026-89108, sits in Manufacturing Integration and Intelligence.
Earlier fixes include CVE-2026-58231 in Commerce Cloud, patched in August. Defused flagged it as actively exploited days after the patch. In September, SAP fixed CVE-2026-44756 in the SAP Kernel, which Onapsis named OVERPASS. At the time, Onapsis judged that more than 10,000 SAP systems reachable from the internet run the affected component.
These are separate flaws in separate products. They do not show a trend on their own. What they do show is how widely SAP software is used: BleepingComputer reports that 99 of the world's 100 largest companies are SAP customers.
Three of those 14 were abused in ransomware attacks, according to the same report.
What to ask your team
Start with inventory. Which of our applications use the SAP Cloud SDK for Python, and which version? Any answer below 0.45.2 needs an owner and a date for the update.
Next, trace the input. Where does tenant_subdomain come from in each app: a hostname, a URL path, a login form? Is it checked against our list of real tenants before it reaches the SDK? If a patch cannot ship yet, SAP names that allowlist as the interim step.
Then ask about the secrets. If an app took untrusted tenant values before the fix, can the team tell whether credentials went anywhere unexpected? Can they rotate those credentials quickly? The sources do not report attacks on this flaw, but rotation is a sound question to answer before you need it.
Last, ask who owns AI agents built on this toolkit. An agent that holds client credentials carries the same exposure as any other app that holds them.
The takeaway is simple. Any customer-supplied word that ends up inside a web address needs the same scrutiny as a password field.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: SAP SE (SAP Cloud SDK for Python GitHub security advisory GHSA-4mv3-jxxm-9cx2).
