Threat Intelligence

Critical SAP Python SDK Flaw Could Leak Cloud Credentials, and Some Fixed Versions May Still Be Exposed

The Hacker News · 14 Oct 2026

Key Takeaway If your business builds on SAP BTP with the Cloud SDK for Python, check which version you run and move to 0.55.1 or later (0.58.4 was the newest on October 13) rather than assuming any release after 0.45.2 is safe.

SAP has disclosed a critical flaw, tracked as CVE-2026-89111 with a CVSS score of 10.0 out of 10, in its Cloud SDK for Python. In an advisory published on October 13, SAP said the flaw can send an application's OAuth2 client credentials (a client ID and secret) to a server an attacker controls. It affects multi-tenant applications on SAP Business Technology Platform that use the SDK, and an attacker must be able to control the tenant subdomain the application passes to it. SAP names version 0.45.2, released on August 21, as the fix. That version rejects any tenant subdomain that is not a simple name.

The Hacker News found that the check is not applied everywhere. Versions 0.53.0 through 0.55.0 skip it when an application uses the SDK's Destination service module, because 0.53.0 moved that module onto new shared token code without the check. Version 0.55.1 restored it. Running SAP's own tests, The Hacker News found the six releases failed 9 of 11 tests. Versions 0.36.1 and 0.36.2 also lack the check, and upgrading within the 0.36 line does not add it.

As of October 13, the advisory lists no version above 0.45.2 as affected, and neither it nor the release notes say whether the six releases fall under the CVE. Versions 0.45.2 through 0.52.2 and 0.55.1 through 0.58.4 contain the check. Version 0.58.4 was the newest release on PyPI that day.

SAP CVE-2026-89111 OAuth2 Python Supply Chain Cloud Security

Summarised by CISO AI from The Hacker News, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.