15 OCT 2026 — SAP has fixed a flaw in its Cloud SDK for Python that it scores at the maximum 10.0, because in the wrong conditions it hands an attacker the OAuth2 client credentials a business application uses to talk to SAP's cloud. The fix is version 0.45.2 of the open-source sap-cloud-sdk package. For teams that cannot upgrade at once, SAP describes a simple check that blocks the attack.
Whether your application is exposed comes down to one field: tenant_subdomain.
What the flaw does
The SDK is SAP's official toolkit for building Python applications and AI agents on its Business Technology Platform (BTP). In multi-tenant BTP applications, each customer tenant is identified by a subdomain, and the SDK uses that value to build the address it requests OAuth2 tokens from. According to SAP's security advisory, "an attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated".
That is a server-side request forgery: the application is tricked into sending a sensitive request, carrying its own secrets, somewhere it should not. Client credentials are the keys an application uses to act on its own behalf, so losing them can expose whatever that application is allowed to reach.
Why the score is a maximum
The advisory's vector reads network-reachable, low complexity, no privileges and no user interaction, with a changed scope and high impact on confidentiality and integrity. The scope change is what pushes it to 10. Stolen credentials let an attacker reach beyond the vulnerable library into the systems the application connects to.
A vector, though, describes the flaw in the worst plausible setting. The attack depends on the application passing a subdomain value that an outsider can influence. An application that only ever takes the tenant from trusted platform metadata may not give an attacker that lever. That is a question each team has to answer about its own code, which is why a top score is a reason to look first, not a verdict on any particular deployment. It is also why our guide argues that a CVSS number is not a patch queue. Readers can rebuild the vector in our CVSS 3.1 calculator, a RECATOOLS tool.
The fix and the workaround
Version 0.45.2 validates tenant_subdomain against the DNS label rules in RFC 1123 before putting it into a token URL, so a value crafted to point elsewhere is rejected. SAP's interim advice for applications that cannot upgrade immediately is stricter still: check the subdomain against an allowlist of the tenants actually registered, before passing it to any SDK call. The flaw was reported to SAP by a researcher credited as SunandM.
The allowlist is worth keeping even after upgrading. Format validation stops malformed input, while an allowlist also stops a well-formed subdomain that simply is not yours.
The rest of SAP's October fixes
The SDK flaw was one of 20 issues addressed in SAP's October security updates, BleepingComputer reported. Two others were rated critical: CVE-2026-89110, a broken access control flaw in NetWeaver Visual Composer that could let an attacker with limited privileges take over a system, and CVE-2026-89108 in SAP Manufacturing Integration and Intelligence.
SAP patches have attracted attackers quickly this year. In August, a maximum-severity flaw in SAP Commerce Cloud was exploited within days of its fix. As of writing, no exploitation of the Python SDK flaw had been reported.
What developers should do
Teams running Python applications on BTP should check the sap-cloud-sdk version they ship and move to 0.45.2 or later. Then trace where tenant_subdomain comes from in the code. If any path lets a request header, query string or user-supplied field set it, treat the application as exposed, add the allowlist, and consider rotating the client credentials it uses.
View author profile → · Editorial policy
