Description
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.
Published: 2026-10-13
Score: 10 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Credential exfiltration via OAuth2 token requests
Action: Apply Patch
AI Analysis

Impact

This vulnerability allows a remote attacker who can control the tenant_subdomain parameter to trigger a server‑side request forgery against the OAuth2 token endpoint. By redirecting requests to an attacker‑controlled server, the application can inadvertently expose client credentials to the attacker. The weakness is classified as CWE‑918.

Affected Systems

SAP Cloud SDK for Python used in multi‑tenant BTP applications is affected. No specific version range is provided in the advisory.

Risk and Exploitability

The CVSS score of 10 indicates a critical risk. Although an EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the potential for credential exfiltration remains high. An attacker who can specify the tenant_subdomain value would likely need remote access to application input; once achieved, the SSRF can be executed with network connectivity to the OAuth2 endpoint.

Generated by OpenCVE AI on October 13, 2026 at 03:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest SAP Cloud SDK for Python patch or upgrade to a version that resolves the SSRF issue
  • Restrict control of tenant_subdomain to whitelisted, trusted values only
  • Validate and enforce that OAuth2 token requests do not target external or untrusted hosts

Generated by OpenCVE AI on October 13, 2026 at 03:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Sap Se
Sap Se sap Cloud
Vendors & Products Sap Se
Sap Se sap Cloud

Tue, 13 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
References

Tue, 13 Oct 2026 02:45:00 +0000

Type Values Removed Values Added
References

Tue, 13 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Description The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.
Title OAuth2 SSRF vulnerability in SAP Cloud SDK for Python
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Sap Se Sap Cloud
cve-icon MITRE

Status: PUBLISHED

Assigner: sap

Published:

Updated: 2026-10-30T18:00:40.552Z

Reserved: 2026-09-10T22:24:03.823Z

Link: CVE-2026-89111

cve-icon Vulnrichment

Updated: 2026-10-14T19:14:46.234Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T01:16:47.890

Modified: 2026-10-30T18:18:16.193

Link: CVE-2026-89111

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:23:56Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)