Direct answer
SAP CVE-2026-89111 is a maximum-severity OAuth2 server-side request forgery (SSRF) flaw in the SAP Cloud SDK for Python, rated CVSS 10.0. It affects multi-tenant applications built on SAP Business Technology Platform (BTP) that use Cloud SDK for Python versions before 0.45.2. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to a server they control, and the application then hands its client credentials to that server. Fix it by upgrading to Cloud SDK for Python 0.45.2 or later, and if you cannot patch immediately, validate tenant_subdomain against an allowlist of registered tenant subdomains before passing it to any SDK call.
What happened
On October 13, 2026, SAP released its October 2026 Security Patch Day: 22 new and updated security notes, including four that address critical-severity vulnerabilities. The most severe of the four is CVE-2026-89111, tracked in a GitHub security advisory (GHSA-4mv3-jxxm-9cx2). SAP has not reported any exploitation in the wild for the newly disclosed flaws, but the combination of a maximum CVSS score, no authentication requirement, and credential theft as the payoff means this is not a patch to schedule for next quarter. It belongs at the top of this week patch list.
The timing matters for another reason. The Cloud SDK for Python is SAP official toolkit for building AI agents and Python applications on BTP services. As more teams connect agents and integrations to SAP systems, the credentials these applications carry are becoming higher-value targets. A flaw that leaks those credentials at the token-request stage is exactly the kind of bug attackers look for.
What CVE-2026-89111 is
| Detail | What we know |
|---|---|
| CVE | CVE-2026-89111 |
| CVSS score | 10.0, maximum severity |
| Vulnerability type | OAuth2 server-side request forgery (SSRF) |
| Affected product | SAP Cloud SDK for Python, versions before 0.45.2 |
| Fixed version | 0.45.2 |
| Affected deployments | Multi-tenant BTP applications |
| Authentication needed | None |
| User interaction needed | None |
| Advisory | GHSA-4mv3-jxxm-9cx2 |
In plain terms, SSRF means the application can be tricked into sending a request somewhere it was never supposed to send one. Here, the request that gets redirected is not a random web fetch. It is the OAuth2 token request, the exact request that carries the application client ID and client secret. That is what makes this flaw so dangerous: the attacker does not need to break encryption or guess a password. They just need to control one parameter and wait for the application to deliver its own credentials.
How the attack works
SAP describes the core problem in its advisory: an attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. Here is how that plays out step by step:
- The application takes in a tenant subdomain. In a multi-tenant BTP application, the tenant subdomain identifies which customer tenant a request belongs to. It can arrive from user input, a header, a URL, or another application-level vector.
- The SDK builds the OAuth2 token request using that value. In vulnerable versions, the SDK incorporates the tenant_subdomain value into the token request URL without verifying that it belongs to a registered tenant.
- The request goes to the attacker server instead of the real authorization server. Because the subdomain value is attacker-controlled, the destination of the token request can be a domain the attacker owns.
- The attacker collects the client credentials. The token request includes the OAuth2 client credentials, so the attacker server receives the client ID and secret.
- The attacker uses the stolen credentials. With valid client credentials, the attacker can request legitimate tokens and access BTP resources within the scope those credentials carry, potentially reaching across tenants.
The multi-tenant angle is the part that turns a single-application bug into a platform-wide risk. In a multi-tenant setup, one application serves many customers. Credentials stolen from that application can open doors beyond the one tenant the attacker started with, depending on how the credentials are scoped and what services they can reach.
Why a CVSS 10.0 score is justified here
A CVSS 10.0 is the highest possible score, and it is reserved for flaws that combine the worst properties: exploitable over the network, low complexity, no privileges required, no user interaction, and a change in scope that pushes impact beyond the vulnerable component. CVE-2026-89111 checks every one of those boxes. There is no phishing email to click, no account to compromise first, and no race condition to win. If an application exposes a path where an attacker can influence tenant_subdomain, the attack is straightforward.
The payoff also explains the score. These are not end-user passwords. They are machine credentials: the client ID and secret an application uses to prove its identity to SAP services. Machine credentials often carry broad permissions, run without human oversight, and are rarely rotated unless someone suspects a problem. When they leak, the attacker inherits everything the application was trusted to do. That is also why the fix is not only patching. Any credentials that may have been exposed should be investigated and rotated, not left in place after the upgrade.
For comparison, SSRF flaws have produced maximum-severity scores before when they expose credentials or internal services. SonicWall SMA 1000 faced a similar situation earlier in October with its own CVSS 10.0 SSRF flaw, covered in our SonicWall SMA 1000 SSRF breakdown. The pattern is consistent: when a server-side request can be redirected and the response carries secrets, the severity ceiling is high.
Who is affected
You are affected if you run a multi-tenant application on SAP BTP that uses the SAP Cloud SDK for Python at a version earlier than 0.45.2. Single-tenant applications that never accept an attacker-influenced tenant_subdomain are at lower risk, but the safest check is still to confirm your SDK version and upgrade, because assumptions about which inputs an attacker can reach are exactly how these flaws get missed.
Teams most exposed include:
- Developers shipping multi-tenant SaaS products on SAP BTP with the Python SDK.
- Enterprises running custom BTP extensions or integrations that accept tenant identifiers from external input.
- Teams building AI agents on BTP with the Python SDK, since agent workloads often carry broad API access.
- Vendors whose BTP applications are deployed into customer landscapes they do not directly control.
If you are not sure whether your application uses the SDK, check your dependency lockfiles for sap-cloud-sdk or the Cloud SDK for Python package and confirm the pinned version. If the version is below 0.45.2, treat the application as vulnerable until the upgrade is confirmed.
What to do now
1. Upgrade to Cloud SDK for Python 0.45.2 or later
This is the real fix. Upgrade the SDK in every multi-tenant BTP application, run your test suite, and deploy. If you pin dependencies, update the pin and rebuild. Do not assume a single application is the only one affected; search all repositories and deployment pipelines for the SDK, including internal tools and side projects.
2. Allowlist tenant_subdomain values as a stopgap
If you cannot patch immediately, SAP recommends validating tenant_subdomain against a known allowlist of registered tenant subdomains before passing it to any SDK call. Build the allowlist from your actual tenant registry, not from a pattern or a regular expression that accepts arbitrary subdomains. Reject anything that does not match exactly, and log rejections so you can see whether anyone is probing the parameter.
3. Rotate credentials that may have been exposed
Patching stops future theft. It does not undo theft that already happened. If your application was reachable by untrusted input while running a vulnerable SDK version, rotate the OAuth2 client credentials and review token issuance for those clients. Treat any unfamiliar token activity as a possible compromise until proven otherwise.
4. Review OAuth2 and token activity logs
Look for token requests going to unexpected destinations, tokens issued for clients outside normal patterns, and API calls that do not match the application usual behavior. If you have egress logging, check for outbound token-request traffic to domains outside SAP authorization endpoints during the exposure window.
5. Harden the inputs around tenant routing
Beyond this specific flaw, treat every tenant identifier as untrusted input. Validate it at the edge of your application, not only inside the SDK, and keep tenant resolution on a strict allowlist. The same discipline applies to any parameter that ends up inside a URL your server constructs, which is the root cause class behind SSRF in general.
The urgency here is similar to other actively patched enterprise flaws this month. Ivanti Connect Secure administrators faced a comparable decision when an authentication-bypass zero-day landed in CISA Known Exploited Vulnerabilities catalog, as detailed in our Ivanti Connect Secure zero-day breakdown. The lesson is the same: when the flaw is remotely exploitable without credentials, patch first and investigate in parallel.
Other critical fixes in SAP October 2026 Patch Day
CVE-2026-89111 leads the release, but it is one of four critical flaws in the October 2026 Patch Day. If your landscape includes the products below, do not stop at the Python SDK.
- CVE-2026-89110, CVSS 9.9: broken access control in certain portal functionality of SAP NetWeaver Visual Composer (VC70RUNTIME 7.50). A low-privileged attacker could invoke internal operations on a preconfigured remote system and fully compromise it.
- CVE-2026-89107, CVSS 9.9: code injection in SAP S/4HANA Manage Substitution/Validation Rules functionality (S4CORE versions 105 through 109). An authenticated attacker holding a specific business role in Fiori Applications could submit crafted input and execute arbitrary ABAP code.
- CVE-2026-89108, CVSS 9.1: missing authorization check in the Configuration Service of SAP Manufacturing Integration and Intelligence (XMII 15.4 and 15.5). An attacker with XMII Admin privileges could create an administrator account on the underlying Java application server and fully compromise the system.
SAP also resolved high-severity flaws in Commerce Cloud, NetWeaver, and ABAP Platform covering SQL injection, process crashes, and restriction bypasses. The full set is 22 new and updated security notes, so SAP customers should review the complete Patch Day list against their own product inventory rather than cherry-picking the headlines. Microsoft administrators dealing with a large Patch Tuesday in the same week will recognize the drill, as covered in our October 2026 Patch Tuesday guide.
What SAP has not said
As of publication, SAP has not reported exploitation in the wild for CVE-2026-89111 or the other flaws in this Patch Day. That is good news, but it is not a reason to delay. SAP flaws have a history of attracting attention quickly after disclosure, and CISA has added 14 SAP flaws to its Known Exploited Vulnerabilities catalog since November 2021, three of which were abused in ransomware attacks. A maximum-severity flaw with public technical detail and a simple exploitation concept is exactly the kind of issue that gets weaponized fast.
It is also worth remembering that absence of a public exploit report does not mean absence of probing. Attackers routinely scan for newly disclosed flaws before public proof-of-concept code appears. If your BTP applications are internet-facing, assume probing has already started and close the hole now.
For teams tracking the broader pattern of maximum-severity enterprise flaws this month, the same urgency applied to the Bricksforge WordPress flaw, a CVSS 10.0 remote code execution bug that was actively exploited. Our Bricksforge breakdown shows how quickly a perfect-score flaw can move from advisory to active exploitation.
Frequently asked questions
What is CVE-2026-89111?
CVE-2026-89111 is an OAuth2 SSRF vulnerability in the SAP Cloud SDK for Python, rated CVSS 10.0. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing the application client credentials to be exfiltrated.
Which versions of the SAP Cloud SDK for Python are affected?
Versions before 0.45.2 are affected. Upgrade to 0.45.2 or later to fix the flaw. The issue affects multi-tenant BTP applications that use the SDK.
Does CVE-2026-89111 require authentication to exploit?
No. The flaw can be exploited by a remote attacker without privileges and without user interaction, provided the attacker can influence the tenant_subdomain value used by a vulnerable application.
How do I mitigate CVE-2026-89111 if I cannot patch right away?
Validate tenant_subdomain against a known allowlist of registered tenant subdomains before passing it to any SDK call. Reject anything that does not match exactly. This is a temporary mitigation, not a replacement for upgrading to 0.45.2.
Should I rotate credentials after patching?
Yes, if your application was reachable by untrusted input while running a vulnerable version. Patching stops future theft but does not undo credentials that may already have leaked. Rotate the OAuth2 client credentials and review token activity for signs of misuse.
Is CVE-2026-89111 being exploited in the wild?
SAP has not reported exploitation in the wild for this flaw as of publication. Given the maximum severity and the public technical detail, patch promptly rather than waiting for exploitation reports.
Bottom line
CVE-2026-89111 is a textbook maximum-severity flaw: a single unvalidated parameter, a request that carries secrets, and no authentication standing in the way. If you run multi-tenant BTP applications on the SAP Cloud SDK for Python, upgrade to 0.45.2 now, allowlist tenant_subdomain values in the meantime, and rotate any credentials that may have been exposed. Then work through the rest of the October 2026 Patch Day, because three more critical flaws shipped in the same release.