SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13.
A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13.
The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP's official Python client for BTP services.
More recently, in September, it also fixed the CVE-2026-44756 memory corruption flaw in the SAP Kernel code, dubbed OVERPASS by Onapsis security researchers who reported it.
Another critical flaw patched today in SAP Manufacturing Integration and Intelligence (tracked as CVE-2026-89108 ) lets threat actors with administrator privileges gain admin control over the underlying system by provisioning an elevated-privilege account on the underlying Java app.
SAP labels the flaw server-side request forgery (SSRF), a weakness in which a server can be made to send a request to a destination it did not intend.
SAP has addressed 20 security flaws across multiple products in its October 2026 security updates , including a maximum-severity vulnerability in the Cloud SDK for Python.
According to Onapsis estimates at the time, over 10,000 Internet-facing SAP systems use the vulnerable component and may be exposed to attacks that exploit CVE-2026-44756.
Tracked as CVE-2026-89111 , the maximum-severity vulnerability patched this month can be exploited by remote attackers without privileges to steal credentials.
The flaw is tracked as CVE-2026-89111 and carries SAP's CVSS score of 10.0 out of 10.
Cybersecurity and Infrastructure Security Agency (CISA) has added 14 SAP security flaws to its catalog of actively exploited vulnerabilities since November 2021, three of which were abused in ransomware attacks.
What happened
A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13.
The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP's official Python client for BTP services.
What changed
More recently, in September, it also fixed the CVE-2026-44756 memory corruption flaw in the SAP Kernel code, dubbed OVERPASS by Onapsis security researchers who reported it.
Another critical flaw patched today in SAP Manufacturing Integration and Intelligence (tracked as CVE-2026-89108 ) lets threat actors with administrator privileges gain admin control over the underlying system by provisioning an elevated-privilege account on the underlying Java app.
Who is affected
SAP labels the flaw server-side request forgery (SSRF), a weakness in which a server can be made to send a request to a destination it did not intend.
SAP has addressed 20 security flaws across multiple products in its October 2026 security updates , including a maximum-severity vulnerability in the Cloud SDK for Python.
Why it matters
According to Onapsis estimates at the time, over 10,000 Internet-facing SAP systems use the vulnerable component and may be exposed to attacks that exploit CVE-2026-44756.
Tracked as CVE-2026-89111 , the maximum-severity vulnerability patched this month can be exploited by remote attackers without privileges to steal credentials.
Technical details
The flaw is tracked as CVE-2026-89111 and carries SAP's CVSS score of 10.0 out of 10.
Cybersecurity and Infrastructure Security Agency (CISA) has added 14 SAP security flaws to its catalog of actively exploited vulnerabilities since November 2021, three of which were abused in ransomware attacks.
For instance, it patched CVE-2026-58231 in the Commerce Cloud cloud-based e-commerce platform in August, which threat intelligence firm Defused flagged as actively exploited in attacks days after it was addressed.
Response
SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now
That version and the 11 releases after it passed all 11.
What security teams should do
Version 0.45.2 added a check that rejects any tenant subdomain that is not a simple name.
Six later releases do not apply that check in every case, The Hacker News found.
Attribution
The Hacker News: A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13.
BleepingComputer: SAP has addressed 20 security flaws across multiple products in its October 2026 security updates , including a maximum-severity vulnerability in the Cloud SDK for Python.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.