From SAP’s October 2026 Security Patch Day page and SAP’s own GitHub security advisory. Items marked REPORTED come only from BleepingComputer. No source says any of these flaws is being exploited.
SAP has fixed a vulnerability rated 10.0 out of 10, the highest possible severity score, in its Cloud SDK for Python as part of its monthly Security Patch Day on 13 October 2026 [1][2].
The flaw is tracked as CVE-2026-89111. It affects versions of the SDK before 0.45.2 [1]. The SDK is a software toolkit developers use to build Python apps on SAP’s Business Technology Platform (BTP).
What is the flaw, in plain words?
Two terms help here:
- OAuth2 is a common system that lets one app prove who it is to another and get a temporary access pass, called a token. To get that token, the app sends its own secret login details, called client credentials, to a trusted token server.
- SSRF (server-side request forgery) is when an attacker tricks a server into sending a request somewhere it shouldn’t.
SAP’s advisory says the flaw affects “multi-tenant BTP applications” (apps that serve several customer organisations, or tenants, at once). “An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated” [2]. In other words, the app could be tricked into sending its secret credentials to the attacker instead of to SAP’s real token server.
The advisory’s score details say the attack works over the network, needs no login and no action by a user [2].
How to fix it
- Update the SAP Cloud SDK for Python to version 0.45.2 or later. SAP says this version checks the tenant subdomain is a valid DNS name before using it in a token web address [2].
- If you can’t update yet, SAP says apps can check
tenant_subdomain“against a known allowlist of registered tenant subdomains before passing it to any SDK call” [2].
The other critical fixes
SAP’s page lists 16 new security notes and 4 GitHub security advisories, plus 2 updates to older notes [1]. BleepingComputer counts this as 20 security flaws [3]. Three other fixes are rated Critical by SAP [1]:
- CVE-2026-89110 (9.9): broken access control in SAP NetWeaver Visual Composer. BleepingComputer says it could let remote attackers with limited privileges fully compromise vulnerable systems [3].
- CVE-2026-89107 (9.9): code injection in SAP S/4HANA (Manage Substitution/Validation Rules) [1].
- CVE-2026-89108 (9.1): missing authorisation check in SAP Manufacturing Integration and Intelligence. BleepingComputer says an attacker with administrator privileges could gain admin control over the underlying system [3].
Is it being exploited?
None of the sources TSN checked say these flaws are being exploited in attacks.
What this means
- Developers should act first. This flaw is in a code library, so teams building multi-tenant BTP apps in Python need to update their own apps.
- A stolen credential is a master key. Client credentials can let an attacker act as the app, so updating quickly matters.
- SAP admins have more to patch. Three more Critical fixes cover NetWeaver, S/4HANA and Manufacturing Integration and Intelligence.
Sources
- SAP, “SAP Security Patch Day – October 2026”, 13 October 2026. https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2026.html
- SAP, GitHub security advisory GHSA-4mv3-jxxm-9cx2 (CVE-2026-89111), SAP Cloud SDK for Python. https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-4mv3-jxxm-9cx2
- BleepingComputer (Sergiu Gatlan), “SAP warns of maximum severity OAuth2 SSRF security flaw”, 13 October 2026. https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severity-oauth2-ssrf-security-flaw/
