SAP has identified a severe vulnerability in its Cloud SDK for Python, which could allow attackers to intercept OAuth2 credentials. This flaw impacts multi-tenant applications on the SAP Business Technology Platform (BTP) that utilize this SDK. An attacker could exploit this by manipulating the tenant subdomain, a critical component used by the SDK to determine which tenant’s request is being processed.
Understanding the Vulnerability
The issue, tracked as CVE-2026-89111, has been assigned a CVSS score of 10.0, indicating its critical nature. SAP’s advisory specifies that version 0.45.2, released on August 21, contains the necessary patch to address this vulnerability. The vulnerability arises from the SDK’s handling of authentication using client credentials, which includes a client ID and a secret.
Subsequent versions, particularly 0.53.0 to 0.55.0, inadvertently bypassed a crucial check when handling requests through the SDK’s Destination service module. This oversight was corrected in version 0.55.1, released on September 18, reintroducing the necessary validation to prevent credentials from being sent to unauthorized endpoints.
Implications and Recommendations
The flaw becomes exploitable when the SDK processes a tenant subdomain containing URL delimiters, which can redirect credentials to an attacker’s server. According to SAP’s advisory, the fix ensures that only valid tenant subdomains are accepted, thereby blocking potentially malicious requests.
For users with versions lacking this check, SAP advises either upgrading to a secure version or manually verifying tenant subdomains against a list of registered tenants before SDK integration. Notably, versions 0.36.1 and 0.36.2 also lack this check, despite being released after the initial patch.
Security Measures and Future Updates
To mitigate potential threats, SAP recommends upgrading to versions 0.55.1 through 0.58.4, which include the necessary validation. For those unable to upgrade, a manual comparison of tenant subdomains is advised to prevent unauthorized access.
SAP’s advisory highlights the importance of addressing this server-side request forgery (SSRF) flaw, emphasizing that the vulnerability allows for unintended server requests. The extent of damage an attacker could inflict depends on the permissions associated with the stolen credentials.
The vulnerability was initially present from the SDK’s first appearance on PyPI on March 16. The August update described the fix under bug fixes without mentioning security implications, which were disclosed in the advisory 53 days later. A user from GitHub, SunandM, is credited with bringing this critical issue to SAP’s attention.
