Wednesday 14 October 2026
Night Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

SAP fixes maximum-severity OAuth2 SSRF vulnerability in Cloud SDK for Python

The October 2026 security updates address 20 flaws across multiple products, including a critical bug that could let attackers steal credentials remotely.

By LineZotpaper
Published
Read Time2 min
SAP has released its October 2026 security updates, patching 20 vulnerabilities across various products, including a maximum-severity OAuth2 server-side request forgery (SSRF) flaw in the Cloud SDK for Python that could allow remote attackers to exfiltrate credentials without prior authentication.

The most critical fix addresses CVE-2026-89111, a vulnerability with the highest possible severity rating. According to SAP's advisory, the bug affects multi-tenant BTP applications built using the Python SDK. An attacker who controls the "tenant_subdomain" parameter can redirect OAuth2 token requests to a server they control, causing client credentials to be stolen.

SAP's Cloud SDK for Python is the official toolkit for developing AI agents and Python applications on the company's Business Technology Platform services. The advisory notes that customers who cannot immediately deploy the patch can temporarily mitigate the issue by validating the tenant_subdomain parameter against a known allowlist of registered tenant subdomains.

The October 2026 update also includes fixes for other severe flaws. CVE-2026-89110 is a critical broken access control vulnerability in SAP NetWeaver Visual Composer that could let remote attackers with limited privileges fully compromise affected systems. Additionally, CVE-2026-89108 in SAP Manufacturing Integration and Intelligence allows threat actors with administrator privileges to gain admin control over the underlying system by provisioning an elevated-privilege account on the Java app.

SAP has dealt with several maximum-severity flaws in recent months. In August, it patched CVE-2026-58231 in the Commerce Cloud, which threat intelligence firm Defused flagged as actively exploited shortly after the fix was released. In September, SAP fixed a memory corruption flaw in the SAP Kernel code that security researchers at Onapsis had reported. Onapsis estimated at the time that over 10,000 Internet-facing SAP systems used the vulnerable component.

§

Analysis

Why This Matters

  • The maximum-severity SSRF flaw in the Cloud SDK for Python could allow attackers to steal credentials from multi-tenant BTP applications without needing any prior access, posing a direct risk to enterprise data.
  • With over 10,000 Internet-facing SAP systems recently estimated to use a vulnerable component, the attack surface for SAP environments remains large, and patching delays can lead to exploitation.
  • The vulnerability affects AI agent development on SAP platforms, making this a concern for organizations integrating AI into their business processes.

Background

SAP regularly releases monthly security updates to patch vulnerabilities across its extensive product portfolio. The Cloud SDK for Python is a key tool for developers building applications on SAP's Business Technology Platform, which is widely used by large enterprises for cloud-based operations. SSRF vulnerabilities allow attackers to make server-side requests to internal resources, potentially accessing sensitive data or services. Recent months have seen multiple maximum-severity flaws in SAP products, with some, like the August Commerce Cloud bug, confirmed as actively exploited after patches were released.

Key Perspectives

SAP and Security Teams: They emphasize the importance of applying the October 2026 patches quickly, especially the fix for CVE-2026-89111, and provide a temporary mitigation (allowlist validation) for those unable to update immediately. Enterprise Customers: Organizations using SAP's BTP and the Python SDK face pressure to prioritize patching to prevent credential theft and potential system compromise. Delayed patching could expose them to attacks, as seen with previous SAP flaws. Security Researchers: The ongoing discovery of critical SAP vulnerabilities, including those reported by firms like Onapsis and Defused, highlights the complexity of securing large enterprise suites. They continue to monitor for exploitation of newly disclosed flaws.

What to Watch

  • Whether proof-of-concept exploits for CVE-2026-89111 emerge in the coming weeks, as has happened with recent SAP vulnerabilities.
  • The volume of Internet-facing SAP systems that are patched versus those remaining vulnerable, particularly for the Python SDK flaw.
  • Any reports from threat intelligence vendors of active exploitation attempts targeting the maximum-severity flaw.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe