Ethical Hacking News
SAP has disclosed a critical vulnerability in its Cloud SDK for Python, allowing OAuth2 credential theft. The vulnerability has a CVSS score of 10.0 out of 10 and affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK. A patch is available, and SAP recommends that affected applications upgrade or implement additional security measures to prevent exploitation of this vulnerability.
The SAP Cloud SDK for Python has a critical vulnerability (CVE-2026-89111) that can allow attackers to steal OAuth2 client credentials. The vulnerability is due to a flaw in the SDK's tenant subdomain handling. Only multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK are affected. A patch is available since August 21, and affected applications should compare tenant subdomains with registered tenants or upgrade to a patched release.
SAP has recently disclosed a critical vulnerability in its Cloud SDK for Python, which has the potential to allow attackers to steal OAuth2 client credentials. The vulnerability, tracked as CVE-2026-89111, has a CVSS score of 10.0 out of 10, indicating a severe impact on the security of affected applications.
According to the vulnerability report, the issue arises from a flaw in the SDK's tenant subdomain handling. When an application passes a tenant subdomain to the SDK, the SDK requests an access token for that tenant, which is then sent to a server controlled by the attacker. The attacker can then use this access token to obtain OAuth2 client credentials, which can be used to access sensitive data and services.
The vulnerability is particularly concerning because it affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK. An attacker must be able to control the tenant subdomain in order to exploit this vulnerability. However, SAP has provided a patch for the issue, which has been available since August 21.
The vulnerability was discovered by a GitHub user named SunandM, who reported it to SAP. The report highlights the importance of proper validation and sanitization of user input data to prevent such vulnerabilities. SAP has acknowledged the report and released a security advisory to inform affected customers of the issue and provide guidance on how to mitigate it.
The advisory notes that the vulnerability is tracked as CVE-2026-89111 and affects releases of the Cloud SDK for Python from 0.45.2 to 0.55.0, as well as releases from 0.36.1 and 0.36.2. The advisory also notes that the vulnerability is not limited to these specific releases, and that any release that does not include the tenant subdomain check is potentially vulnerable.
To mitigate the vulnerability, SAP recommends that affected applications compare each tenant subdomain with a list of their registered tenants before passing it to the SDK. The advisory also notes that upgrading to a patched release is the most effective way to prevent exploitation of this vulnerability.
The discovery of this vulnerability highlights the importance of ongoing security testing and vulnerability management in software development. It also underscores the need for developers to carefully validate and sanitize user input data to prevent similar vulnerabilities in the future.
In conclusion, SAP has disclosed a critical vulnerability in its Cloud SDK for Python, which has the potential to allow attackers to steal OAuth2 client credentials. The vulnerability has been patched, but it highlights the importance of ongoing security testing and vulnerability management in software development.
Related Information:
https://www.ethicalhackingnews.com/articles/SAP-Discloses-Critical-Vulnerability-in-Cloud-SDK-for-Python-Allowing-OAuth2-Credential-Theft-ehn.shtml
https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html
https://nvd.nist.gov/vuln/detail/CVE-2026-89111
https://www.cvedetails.com/cve/CVE-2026-89111/
Published: Tue Oct 13 14:38:05 2026 by llama3.2 3B Q4_K_M
