Cybersecurity
SAP patches OAuth2 SSRF flaw in Python SDK
SAP said it had fixed 20 flaws in its October 2026 updates, including an OAuth2 server-side request forgery issue in the Python SDK that could expose credentials.
- SAP said it had addressed 20 security flaws in its October 2026 updates, including a maximum-severity issue in its Cloud SDK for Python.
- The flaw, CVE-2026-89111, affected multi-tenant BTP applications and could let remote attackers without privileges steal credentials.
- SAP said customers could reduce exposure by checking tenant_subdomain values against an allowlist before SDK calls.
- SAP also patched CVE-2026-89110 in NetWeaver Visual Composer and CVE-2026-89108 in Manufacturing Integration and Intelligence.
- The article said Onapsis estimated more than 10,000 Internet-facing systems used the SAP Kernel component patched in September.
SAP said its October 2026 updates covered 20 security flaws across several products, including CVE-2026-89111 in the Cloud SDK for Python. The article said the SAP Python SDK was the company’s toolkit for building AI agents and Python applications on SAP Business Technology Platform services.
According to SAP’s Tuesday advisory, the flaw affected multi-tenant BTP applications. It said an attacker who controlled tenant_subdomain could steer OAuth2 token requests to a server they controlled and obtain client credentials.
SAP said customers who could not install the patch immediately could use an allowlist to check tenant_subdomain values before passing them into SDK calls. It also said CVE-2026-89110 in NetWeaver Visual Composer could allow remote attackers with limited privileges to take over vulnerable systems.
The company also patched CVE-2026-89108 in SAP Manufacturing Integration and Intelligence, which the article said could let an attacker with administrator privileges gain control of the underlying system by creating a higher-privilege account on the Java application. The article noted that SAP had fixed CVE-2026-58231 in Commerce Cloud in August, which Defused said had been actively exploited.
It also said SAP fixed CVE-2026-44756 in the SAP Kernel in September, a flaw Onapsis had dubbed OVERPASS. Onapsis estimated that more than 10,000 Internet-facing SAP systems used the vulnerable component, and the article said CISA had added 14 SAP flaws to its catalogue of actively exploited vulnerabilities since November 2021, three of them used in ransomware attacks.
Named in this story
Companies
- SAP
- said it had addressed the flaws in its October 2026 updates
- Defused
- flagged the August Commerce Cloud flaw as actively exploited
- Onapsis
- reported the SAP Kernel flaw and estimated the exposed systems
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency (CISA)
- had added SAP flaws to its actively exploited catalogue
Products and systems
- SAP Cloud SDK for Python
- contained the OAuth2 SSRF vulnerability
- SAP Python SDK
- was described as the official toolkit for AI agents and Python applications on SAP BTP services
- SAP Business Technology Platform (BTP)
- was the platform whose multi-tenant applications were affected
- SAP NetWeaver Visual Composer
- contained a broken access control flaw patched in the same update
- SAP Manufacturing Integration and Intelligence
- contained a critical flaw patched in the same update
- Commerce Cloud
- was the product patched in August for CVE-2026-58231
- SAP Kernel
- contained the memory corruption flaw patched in September
How the source tells it
The register was mostly that of a technical security update, but it carried urgency through severity labels, exploitability claims and mitigation guidance.
- urgency maximum-severity labelling and temporary mitigation advice
- alarm credential theft and full-compromise outcomes described as direct consequences