SAP patches a CVSS 10 token flaw in its Cloud SDK for Python

SAP patches a CVSS 10 token flaw in its Cloud SDK for Python

13 October 2026: SAP's October Security Patch Day fixes CVE-2026-89111, a server-side request forgery in the SAP Cloud SDK for Python rated 10.0, the highest score CVSS allows. In a multi-tenant application on SAP Business Technology Platform, an attacker who controls the tenant subdomain value can redirect the SDK's OAuth2 token requests to a server of their choosing and collect the application's client credentials. Versions before 0.45.2 are affected.

The release carries 16 new security notes, four advisories published on GitHub and two updates to older notes. Four of the new issues are rated critical. SAP has not reported any of them being exploited.

The four critical notes

• CVE-2026-89111 (10.0), note 3797111: OAuth2 SSRF in SAP Cloud SDK for Python, versions before 0.45.2
• CVE-2026-89110 (9.9), note 3805589: broken access control in SAP NetWeaver Visual Composer, VC70RUNTIME 7.50, which lets a user with low privileges take over the component
• CVE-2026-89107 (9.9), note 3798788: code injection in the Manage Substitution/Validation Rules app of SAP S/4HANA, S4CORE 105 to 109, reachable by an authenticated user with crafted requests
• CVE-2026-89108 (9.1), note 3800517: a missing authorisation check in the configuration service of SAP Manufacturing Integration and Intelligence 15.4 and 15.5, which lets an administrator create an account with higher privileges on the underlying Java application

Below them sit three high severity notes: CVE-2026-89113 (8.8) in SAP Commerce Cloud 2211-JDK21, CVE-2026-58249 (7.5) in the Internet Communication Manager of NetWeaver and the Web Dispatcher across a long list of kernel releases, and CVE-2026-89120 (7.1) in the ABAP Platform kernels 7.93 and 9.16.

Why the SDK flaw is different

Most SAP notes land on systems an SAP basis team already patches every month. The Python SDK does not. It is a library that developers pull into their own BTP applications, so the fix arrives only when someone raises the dependency to 0.45.2 or later and redeploys. A basis team can apply every note this month and still leave this flaw open in an in-house extension that nobody on that team owns.

The stolen item is also unusually valuable. Client credentials for an OAuth2 client let an attacker request tokens as the application, with whatever scopes it was granted, until the secret is rotated. Until an upgrade is in place, a sensible stopgap is to check the tenant subdomain against the list of registered tenants before it is passed to any SDK call. Teams that find a vulnerable build in production should rotate the client secret as well as upgrade, since an upgrade alone does not revoke credentials that may already have leaked.

Where S/4HANA customers should look first

The S/4HANA and Visual Composer flaws both score 9.9 and both need only a logged-in user, so they matter most where many people hold some access. The Visual Composer component has a history: a critical flaw in the same component was exploited widely in 2025, and many landscapes still expose it. The ICM and Web Dispatcher note touches internet-facing infrastructure across kernel releases and is worth scheduling even though it is rated high rather than critical.

SAP in our catalogue

Our enterprise resource planning software category lists 11 products, among them SAP S/4HANA.

Sources

• SAP: Security Patch Day, October 2026, 13 October 2026
• GitHub advisory database: CVE-2026-89111, SAP Cloud SDK for Python, 13 October 2026
• Canadian Centre for Cyber Security: SAP security advisory AV26-1030, 13 October 2026
• heise online: Patchday SAP, 13 October 2026