CVE-2026-89111

CVE-2026-89111 is an OAuth2 Server-Side Request Forgery (SSRF) vulnerability in the SAP Cloud SDK for Python, which is used to build multi-tenant applications on the SAP Business Technology Platform (BTP). The flaw arises when the SDK fails to properly validate the `tenant_subdomain` parameter. An unauthenticated remote attacker can exploit this by manipulating the parameter to redirect OAuth2 token requests to an external, attacker-controlled server. This redirection allows the attacker to capture and exfiltrate sensitive client credentials, such as client IDs and client secrets, potentially granting unauthorized access to BTP services and data. The vulnerability affects versions of the SAP Cloud SDK for Python prior to 0.45.2. SAP initially addressed the issue in version 0.45.2 by implementing a validation check that rejects any tenant subdomain containing URL delimiters or complex characters. However, reports indicate that several subsequent releases (versions 0.53.0 through 0.55.0) inadvertently bypassed this check in certain modules, a regression that was later resolved in version 0.55.1. For organizations unable to immediately upgrade to a patched version, a recommended mitigation is to manually validate the `tenant_subdomain` parameter against an allowlist of registered subdomains before passing it to any SDK calls.