SAP’s October 2026 patch day fixed the worst kind of bug: a CVSS 10.0 vulnerability that lets an unauthenticated attacker steal the OAuth2 client credentials an AI agent uses to talk to SAP’s cloud. The flaw, CVE-2026-89111, lives in the SAP Cloud SDK for Python — SAP’s official toolkit for building AI agents and Python apps on the Business Technology Platform — and it hinges on a single unvalidated input. By the end of this post you’ll know exactly which versions are affected, how the exploit works, and how to patch and verify in four steps.
What CVE-2026-89111 actually does
SSRF stands for Server-Side Request Forgery: an attacker tricks your server into making a network request they choose. OAuth2 is the standard protocol apps use to prove who they are and get access tokens. CVE-2026-89111 combines the two in the worst possible place — the token request itself.
The Cloud SDK for Python takes a parameter called tenant_subdomain to identify which customer tenant a request belongs to in multi-tenant BTP applications. SAP’s advisory says it plainly: “An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.”
Read that again. The SDK builds its OAuth2 token request around the value of tenant_subdomain. Hand it a crafted value and the request goes to the attacker’s server — carrying your application’s OAuth2 client ID and secret, the standing credentials your software uses to authenticate on SAP’s cloud. No login needed. No privileges. No user has to click anything. Remote, unauthenticated, zero interaction — that’s the recipe for a 10.0.
The affected modules named in reports include the Agent Gateway, Destination, and Document Management Service flows — exactly the paths an AI agent would use to fetch data, destinations, and documents on BTP.
Why agent builders should care
An AI agent’s OAuth2 client credentials are more valuable than a user’s password. Agents hold standing credentials that work across tenants, and a stolen client secret doesn’t expire on logout. If you orchestrate SAP data through n8n workflows, or you run agents on BTP that call SAP services, this flaw sits directly on your credential path.
The timing also matters. SAP’s patch day on Tuesday, October 13, 2026 shipped 22 new and updated security notes, four of them critical. The SDK bug was the worst of the batch, and as of October 14 there was no confirmed in-the-wild exploitation — the narrow window where patching actually beats the attackers is still open.
The one-line takeaway: a single input field your code passes to an SDK became a credential exfiltration channel.
Prerequisites
- Access to the machine or repo where you use SAP Cloud SDK for Python
- Your SDK version number (Step 1 shows you how)
- Permission to upgrade packages and rotate OAuth2 credentials
Step 1 - Check your SDK version
Run this in the environment where your SAP-connected app runs:
pip show sap-cloud-sdk 2>/dev/null | grep -E "Name|Version"SAP lists versions earlier than 0.45.2 as vulnerable, with 0.45.2 as the patched release. There is a wrinkle to know about: independent testing reported that tenant-subdomain validation was missing again in versions 0.53.0 through 0.55.0, and restored in 0.55.1. So the real rule is:
- Below 0.45.2: vulnerable, upgrade now
- 0.45.2 up to and including 0.52.x: patched
- 0.53.0–0.55.0: reported validation gap — treat as vulnerable
- 0.55.1 and above: patched again
If your version falls anywhere in the vulnerable ranges, don’t stop at upgrading — assume exposure until you’ve completed Step 4.
Step 2 - Upgrade to the fixed release
Upgrade to at least 0.45.2 — or 0.55.1+ if you were on the 0.53.x line:
pip install --upgrade "sap-cloud-sdk>=0.55.1"You should see the installed version report 0.55.1 or higher. Why the floor instead of “latest”: pinning a known-fixed floor keeps future pip install -r requirements.txt runs from silently landing back on a broken intermediate release. Update your lockfiles (pip freeze > requirements.txt or your Poetry/uv equivalent) and redeploy.
Warning: The validation gap in 0.53.0–0.55.0 means “I’m already on a recent version” is not enough. Check the exact version number, not just that it’s “this year’s release.”
Step 3 - Allowlist tenant subdomains (defense in depth)
For anyone who can’t upgrade immediately — and as permanent hardening regardless — SAP’s advisory gives an explicit mitigation: validate tenant_subdomain against an allowlist of registered tenant subdomains before it ever reaches an SDK call.
REGISTERED_TENANTS = {"acme-prod", "acme-dev", "globex-prod"}
def get_tenant_subdomain(request_value: str) -> str:
# Reject anything that isn't a tenant we actually registered.
if request_value not in REGISTERED_TENANTS:
raise ValueError(f"Unrecognized tenant: {request_value!r}")
return request_value
# Every SDK call goes through this gate — never pass raw input directly.
client.call_agent_gateway(tenant_subdomain=get_tenant_subdomain(raw_input))The allowlist works because the attack depends entirely on a crafted subdomain. A strict membership check on a known-good set closes the hole at your layer even if the SDK layer regresses again — which, per the 0.53.0–0.55.0 episode, is not hypothetical.
Step 4 - Verify the patch and rotate exposed credentials
Three checks, in order:
- Confirm the fix on disk. Re-run Step 1 and verify the version is 0.45.2+/0.55.1+ everywhere the app runs — CI images, containers, and serverless layers each have their own dependency copy.
pip show sap-cloud-sdk 2>/dev/null | grep -E "Name|Version"
# Expect: Version: 0.55.1 (or higher)-
Look for evidence of exploitation. Audit outbound requests to SAP’s token endpoints from before the upgrade. Any token request aimed at a host that is not SAP’s BTP infrastructure is a red flag — the exploit redirects token traffic to attacker-controlled servers.
-
Rotate OAuth2 client credentials if exposure is plausible. Patching closes the hole; it does not undo credentials already exfiltrated. Regenerate client secrets for every multi-tenant app that used a vulnerable version with externally reachable
tenant_subdomaininput, and revoke the old ones. A rotated secret is the only way to be sure a stolen credential is worthless.
What I didn’t test
I don’t run a BTP tenant, so I didn’t reproduce the exploit — the technical details here come from SAP’s advisory, BleepingComputer’s coverage, and an independent security report, all cross-checked against each other. The version-gap detail (0.53.0–0.55.0) comes from a single independent report; I treated it as real because it errs on the side of upgrading, but confirm against SAP’s current advisory for your exact version.
One more limit: the temporary allowlist mitigation is SAP’s recommendation, not a substitute for the patched SDK. It stops this specific SSRF vector, not the next bug in the same code path.
FAQ
Does this affect me if I don’t use SAP?
If you never touch SAP Cloud SDK for Python or BTP, no. But the pattern is worth learning: any SDK that builds auth requests from unvalidated tenant inputs has this shape of bug. Audit your own agent tooling for it.
Is there a public exploit?
As of October 14, 2026, reports indicated no confirmed in-the-wild exploitation and no public exploit code for CVE-2026-89111. SSRF-of-this-shape PoCs tend to appear quickly, so treat this as a short runway, not a reprieve.
What else did SAP’s October patch day fix?
Three other criticals: CVE-2026-89110 (CVSS 9.9, broken access control in NetWeaver Visual Composer), CVE-2026-89107 (CVSS 9.9, ABAP code injection in S/4HANA), and CVE-2026-89108 (CVSS 9.1, privilege escalation in SAP Manufacturing Integration and Intelligence). All 22 notes are on SAP’s support portal — apply as a priority.
GitHub advisory reference?
The Cloud SDK flaw is tracked under GHSA-4mv3-jxxm-9cx2.
Key Takeaways
- CVE-2026-89111 (CVSS 10.0) lets an unauthenticated attacker steer SAP Cloud SDK for Python’s OAuth2 token requests via an unvalidated
tenant_subdomain, exfiltrating client credentials. - Upgrade to 0.45.2+ — or 0.55.1+ if you were on the 0.53.x line, where a validation gap was independently reported.
- Allowlist tenant subdomains as permanent defense in depth; the 0.53.0–0.55.0 regression proves the SDK layer alone isn’t enough.
- Rotate credentials after patching if exposure was plausible — the fix doesn’t revoke what was already stolen.
Next: audit your agent stack for the same pattern — any place tenant or URL input flows into an authentication request unvalidated. The SAP bug is the one that got caught; it won’t be the last.
Sources: SAP October 2026 patch-day coverage via BleepingComputer, SecurityWeek, The Cyber Express.
Images: Pexels