{"id":"CVE-2026-89111","published":"2026-10-13T01:16:47.890","lastModified":"2026-10-15T20:38:04.303","description":"The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-4mv3-jxxm-9cx2","tags":[]},{"url":"https://url.sap/sapsecuritypatchday","tags":[]}],"exploitRefs":[{"url":"https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-4mv3-jxxm-9cx2","tags":[]}],"hasPoc":true,"ai":{"summary":"The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability that allows attackers to redirect token requests to attacker-controlled servers, enabling exfiltration of client credentials. This affects multi-tenant BTP applications and represents a critical security flaw.","exploitability":"Exploitation is straightforward with minimal preconditions - an attacker needs only control over the tenant_subdomain parameter to redirect OAuth2 token requests.","blast_radius":"If exploited, this vulnerability could lead to widespread credential exfiltration across multiple tenant applications, potentially enabling attackers to impersonate legitimate clients and access sensitive data.","remediation":"Upgrade to SAP Cloud SDK for Python version 2.590 or later to address the OAuth2 SSRF vulnerability.","detection":"Monitor for unusual outbound connections from application servers to external IP addresses during OAuth2 token exchange operations, particularly when tenant_subdomain parameter is present in requests.","tags":["ssrf","oauth2","cloud-sdk","python","btp"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:45:18.923Z"}}