OAuth2 SSRF Vulnerability in SAP Cloud SDK for Python Affects Multi-Tenant Applications

CVE-2026-89111

What is CVE-2026-89111?

The SAP Cloud SDK for Python is susceptible to an OAuth2 Server-Side Request Forgery (SSRF) vulnerability that impacts multi-tenant applications hosted on SAP Business Technology Platform. This issue arises when an attacker manipulates the tenant_subdomain parameter, allowing them to redirect OAuth2 token requests to a malicious server. Such a redirection can lead to the exfiltration of sensitive client credentials, putting user data at risk and compromising application security.

References