SAP Cloud SDK for Python Lets Attackers Steal OAuth2 Credentials Through a Tenant Subdomain Input — CVSS 10.0
SAP Cloud SDK for Python has a critical vulnerability (CVE-2026-89111, CVSS 10.0) allowing attackers to steal OAuth2 credentials via tenant subdomain manipulation. The flaw affects multi-tenant SAP BTP applications. A fix was released in August 2026, but later versions reintroduced the issue. The vulnerability existed since the SDK's initial release in March 2026.
How this was made
The 30-second read
Why it matters
The vulnerability could expose client credentials, prompting customers to assess exposure and possibly switch to alternative platforms.
Market read
Security flaw may trigger short‑term sell pressure on SAP shares and increase attention on software supply‑chain risks.
What to watch
Potential for increased demand for third‑party security solutions and consulting services.
Background
The article reports the first public disclosure of a critical security flaw in SAP's Python SDK, detailing affected versions and the patch timeline.
Ticker impact
SAP disclosed a critical CVE-2026-89111 in its Cloud SDK for Python that allows credential theft via SSRF.
likely pressure as investors price in potential remediation costs and reputational risk
The CVSS 10.0 rating and multiple affected SDK releases suggest material risk, prompting short‑term sell pressure.
Market effects
May raise scrutiny of other enterprise‑software SDKs and cloud‑platform security practices.
Primarily affects European and US enterprise‑software markets where SAP has significant exposure.
Highlights broader supply‑chain security risks in cloud development tools.
Counterpoint
If SAP quickly rolls out patches, the issue could be contained with limited long‑term impact.
Key entities
- companySAP
German enterprise‑software giant providing the vulnerable SDK.
