Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2026-89111

OAuth2 SSRF vulnerability in SAP Cloud SDK for Python

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP Cloud

Default version status: unaffected

  • sap-cloud-sdk < 0.45.2affected

References