CVE-2026-89111: Critical SAP Cloud SDK SSRF

SAP has disclosed CVE-2026-89111, a maximum-severity server-side request forgery (SSRF) vulnerability in SAP Cloud SDK for Python that can expose OAuth2 client credentials.

What Is CVE-2026-89111?

CVE-2026-89111 (CVSS 10.0), also tracked as GHSA-4mv3-jxxm-9cx2, is a CWE-918 SSRF vulnerability affecting OAuth2 token requests.

The SDK builds a tenant-specific token URL using tenant_subdomain. In vulnerable versions, insufficient validation can allow an attacker-controlled value to redirect the request to another server, causing the application to send its OAuth2 client ID and client secret to an unintended destination.

This indicates network reachability, low complexity, no required privileges or user interaction, and potentially high confidentiality and integrity impact.

SAP fixed the issue by validating tenant_subdomain against RFC 1123-style DNS label rules before inserting it into token URLs.

Which SAP Cloud SDK Versions Are Affected?

SAP’s formal advisory identifies:

However, independent testing by The Hacker News found an important later-version gap. Versions 0.53.0 through 0.55.0 did not consistently apply the validation in some Destination-service paths; version 0.55.0 also showed the issue in Document Management Service handling. Validation was restored in shared token-requesting code in 0.55.1.

Testing reported the validation present in 0.45.2–0.52.2 and 0.55.1–0.58.4. SAP’s advisory currently does not state whether the 0.53.0–0.55.0 behavior is formally covered by CVE-2026-89111.

Organizations running those intermediate releases should therefore review their module usage and consider moving to 0.55.1 or later, where compatible.

How Could CVE-2026-89111 Be Exploited?

An attacker must be able to influence the tenant subdomain supplied by a multi-tenant application.

If the affected SDK path accepts the malicious value, the OAuth2 token request can be redirected to an attacker-controlled server, potentially exposing reusable application credentials.

The practical impact depends on the OAuth2 client’s roles and scopes. Stolen credentials could provide access to BTP services available to that client, but the vulnerability does not automatically provide administrative access or remote code execution.

The affected flows include the Agent Gateway, Destination, and Document Management Service modules.

Is CVE-2026-89111 Being Exploited?

No confirmed exploitation has been reported as of October 14, 2026.

SAP’s advisory does not report attacks, and the current review found no confirmed CISA KEV listing or reliable public exploit.

The absence of active exploitation does not reduce the need to patch: exposed OAuth2 credentials can remain useful beyond the original request if their scopes permit access to sensitive services.

Other SAP October 2026 Security Patch Day Highlights

SAP’s October 2026 Security Patch Day included 16 new security notes, four GitHub security advisories, and two updates to previous notes. SAP recommends applying the patches on priority.

Other notable vulnerabilities include:

• CVE-2026-89110 (CVSS 9.9): Broken access control in SAP NetWeaver Visual Composer.
• CVE-2026-89107 (CVSS 9.9): Code injection in SAP S/4HANA Manage Substitution/Validation Rules.
• CVE-2026-89108 (CVSS 9.1): Missing authorization check in SAP Manufacturing Integration and Intelligence.
• CVE-2026-89113 (CVSS 8.8): SQL injection in SAP Commerce Cloud.

These should be reviewed alongside CVE-2026-89111 based on which SAP products are present in the environment.

Track CVE-2026-89111 with SOCRadar

SOCRadar’s Cyber Threat Intelligence module provides timely visibility into actively exploited vulnerabilities by aggregating CVE disclosures, exploitation evidence, threat actor activity, and CISA KEV updates in one place. This enables security teams to quickly understand whether a vulnerability like CVE-2026-89111 is being abused in real-world attacks and how it is being leveraged.

In addition, SOCRadar’s Attack Surface Management (ASM) module continuously maps internet-facing assets and identifies exposed services and devices. By linking threat intelligence with asset visibility, teams can determine whether affected products are reachable and prioritize remediation efforts based on actual exposure.

What Should Defenders Do?

Upgrade affected sap-cloud-sdk deployments to a validated fixed release. SAP officially lists 0.45.2 as the patch, while environments running 0.53.0–0.55.0 should review the independently reported validation gap.

If upgrading is delayed, SAP recommends validating tenant_subdomain against an allowlist of registered tenant names before passing it to any SDK call.

Defenders should also review outbound OAuth2 token requests for unexpected destinations, inspect proxy and DNS telemetry, and check BTP audit logs for unusual use of affected client identities.

Where suspicious redirection is identified, determine whether client credentials may have been exposed and consider rotating secrets and reviewing the permissions assigned to those clients.