SAP discloses CVSS 10 flaw in Cloud SDK for Python
A flaw in SAP's Python SDK can leak OAuth2 client credentials when attackers control a tenant subdomain; the fix history is more complicated than one version number.
SAP says a critical flaw in its Cloud SDK for Python can send an application's OAuth2 client credentials to an attacker-controlled server when a multi-tenant application accepts a malicious tenant subdomain. The vulnerability is tracked as CVE-2026-89111 and carries a CVSS score of 10.0 out of 10.12
What is affected
The SDK is SAP's official Python client for Business Technology Platform services. The issue matters to multi-tenant applications that pass tenant subdomains to the SDK while using OAuth2 client credentials — a client ID and secret — to request access tokens.1
SAP's advisory lists versions below 0.45.2 as affected, with 0.45.2 adding a check that rejects tenant subdomains that are not simple names. However, later releases in the 0.53.0 to 0.55.0 range also missed that check in the Destination service module after it moved to shared token-request code.12
The fix is not one version
Version 0.55.1 added the missing check to the Destination path. The Hacker News found that versions 0.53.0 through 0.55.0 failed nine of 11 tests SAP later added, while 0.55.1 and the following 11 releases passed all 11.1
The affected check accepts a single tenant name made from letters, digits and hyphens, up to 63 characters. Values containing URL delimiters now raise a ValueError instead of being used to construct a potentially attacker-controlled token URL.2
SAP's advisory currently says that versions 0.45.2 and later are not affected, but it does not explicitly classify the six later releases that failed the newer tests. The safest route for teams using the SDK is to move to a release containing the check in every relevant module. Version 0.58.4 was the newest release on PyPI when the issue was reported.3
Applications that cannot upgrade should compare each tenant subdomain with their registered-tenant list before passing it to the SDK, as SAP recommends. Organisations should also assess whether credentials could have been exposed if they ran a release without the validation check; the advisory does not say whether credential rotation is required.2
Our opinion
A CVSS 10.0 label is justified here: the failure sits in the path that turns tenant input into an OAuth2 token request, so a bad value can redirect secrets rather than merely break a request. The awkward part is the version story. A single headline fix is not enough when a later refactor reintroduced the missing validation in one module, so affected teams should verify the exact release and service path they run instead of assuming any post-0.45.2 build is safe.