# SAP Cloud SDK for Python sends OAuth2 client secrets to an attacker-chosen host

Source: https://startwithidentity.com/cves/cve-2026-89111/
Last updated: 2026-10-13
License: content by Start with Identity. Cite the source URL.

---

## What broke

CVE-2026-89111 (CVSS 10.0, CWE-918) sits in how the SAP Cloud SDK for Python builds OAuth2 token URLs for multi-tenant applications on SAP Business Technology Platform. The SDK takes the token endpoint from configuration and substitutes the tenant subdomain into it. Before version 0.45.2 it used whatever value it was given, so an attacker who controls `tenant_subdomain` could point the token request at their own server. The SDK then sent the application's [client credentials](https://startwithidentity.com/glossary/client-credentials/), its client ID and client secret, to that host.

The fix in 0.45.2 rejects any subdomain that is not a valid RFC 1123 DNS label. SAP published the advisory (GHSA-4mv3-jxxm-9cx2) on October 13, 2026, 53 days after the fix shipped as an unlabelled bug fix on August 21. No exploitation is reported.

Testing by The Hacker News found the check missing again in releases 0.53.0 through 0.55.0 and in the whole 0.36 line, which SAP's advisory does not list. Releases 0.45.2 to 0.52.2 and 0.55.1 or later contain it.

## Why it matters

In the [client credentials](https://startwithidentity.com/glossary/client-credentials/) grant the secret is the application's identity. Whoever holds it can request tokens as the app, with every scope the app was granted, from anywhere, and no user or MFA prompt is involved. The bug is a confused-deputy: the SDK authenticated faithfully, just to the wrong [authorization server](https://startwithidentity.com/glossary/authorization-server/), because it trusted a tenant-supplied value to build the address of a trusted endpoint.

## What to do

- Upgrade `sap-cloud-sdk` to 0.55.1 or later. Do not stop at 0.53.0 to 0.55.0 or stay on any 0.36 release.
- Where you cannot upgrade yet, compare each tenant subdomain against your list of registered tenants before passing it to the SDK.
- Never build token endpoint URLs from request data. Pin the authorization server per tenant in configuration.

## After you patch

- Rotate the client secrets of any application that ran an unchecked release with attacker-reachable tenant input. SAP's advisory does not say this, but a secret sent to an unknown host should be treated as disclosed.
- Review token issuance logs on your BTP authorization service for client credential grants from unfamiliar addresses.

## Sources

- [NVD: CVE-2026-89111](https://nvd.nist.gov/vuln/detail/cve-2026-89111)
- [SAP advisory GHSA-4mv3-jxxm-9cx2](https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-4mv3-jxxm-9cx2)
- [The Hacker News, October 13, 2026](https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html)