SAP has disclosed a critical vulnerability in its Cloud SDK for Python that could lead to the exposure of OAuth2 client credentials. This flaw, identified as CVE-2026-89111, affects multi-tenant applications on the SAP Business Technology Platform (BTP) that utilize the SDK. An attacker could exploit this by controlling the tenant subdomain, allowing unauthorized access to sensitive client credentials.

SAP initially addressed the issue in version 0.45.2, released on August 21, by implementing a check to prevent malicious subdomain inputs. However, subsequent releases from 0.53.0 to 0.55.0 did not consistently apply this check, posing a potential security risk. The oversight was corrected in version 0.55.1, which reinstated the critical validation.

Testing conducted by The Hacker News revealed that six SDK releases failed nine out of eleven security tests introduced in version 0.55.1. Although versions 0.45.2 through 0.52.2 and 0.55.1 onwards have the necessary check, earlier releases, including two from the older 0.36 line, remain vulnerable.

SAP advises that affected applications unable to upgrade immediately should manually verify tenant subdomain inputs against a registered list before passing them to the SDK. The flaw is categorized as server-side request forgery (SSRF), allowing an attacker to redirect requests to an unintended server, potentially compromising OAuth2 credentials. While the advisory does not specify the actions an attacker could perform with the credentials, the implications depend on the permissions granted to the application's client.