BuildRiot
Sign in

BackendSource: BleepingComputer

SAP discloses Cloud SDK for Python flaw as report flags gaps in later releases

SAP disclosed a patched Cloud SDK for Python flaw that it says can expose application credentials. The Hacker News reported missing protection in later releases, so developers should check tenant-input validation.

By News DeskPublished here (UTC)2 min read
SAP logo
Cover: BuildRiot

SAP disclosed a patched credential-theft vulnerability in its Cloud SDK for Python on October 13, 2026. The flaw, CVE-2026-89111, affects the sap-cloud-sdk pip package; SAP assigned it a Common Vulnerability Scoring System 3.1 score of 10.0. Sources: SAP

SAP says attackers controlling tenant_subdomain in multi-tenant SAP Business Technology Platform applications can redirect OAuth2 token requests to their server and capture application client credentials. SAP classifies the flaw as server-side request forgery and lists versions below 0.45.2 as affected, with 0.45.2 patched. According to SAP, the fix checks tenant subdomains against RFC 1123 domain-name label rules before inserting them into token URLs. Sources: SAP

The Hacker News reported a regression across six releases, 0.53.0–0.55.0, affecting Destination calls and, in 0.55.0, Document Management Service calls. The outlet said those releases failed 9 of 11 SAP validation tests, while versions 0.55.1–0.58.4 passed all 11. Sources: The Hacker News

SAP’s 0.55.1 release notes document another validation fix but do not explicitly connect it to CVE-2026-89111 or establish the full reported regression range. The release title gives September 18, 2025, as its date, conflicting with The Hacker News’s account of a follow-up fix shortly before disclosure in 2026. Sources: The Hacker News, SAP

SAP’s advisory does not report exploitation or confirmed credential theft. As a temporary mitigation, SAP advises checking tenant subdomains against an allowlist of registered tenants before any SDK call. Sources: SAP

What to do

  1. Inventory deployed sap-cloud-sdk versions and check whether untrusted input can reach tenant_subdomain.
  2. Verify tenant_subdomain validation in the modules in use, accounting for the reported 0.53.0–0.55.0 regression and the validation fix documented in 0.55.1.
  3. Apply SAP’s temporary mitigation by checking tenant_subdomain against an allowlist of registered tenants before any SDK call. Sources: SAP, The Hacker News

Why it matters

SAP says attacker-controlled tenant input can expose application credentials. The reported regression means developers should verify validation in the modules they use rather than assume every release after 0.45.2 is protected.

Attribution

Sources

  1. 1BleepingComputerSAP warns of maximum severity OAuth2 SSRF security flawSource published (UTC)
  2. 2SAPOAuth2 SSRF vulnerability in SAP Cloud SDK for PythonSource published (UTC)
  3. 3The Hacker NewsSAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
  4. 4SAPRelease v0.55.1 - September 18, 2025Source published (UTC)

Read the original source for full details and context.

Report a problem

Links, dates or what you expected. Do not include passwords or private data.

More on Backend

All Backend stories

AI

Google adds QueryData preview to Firestore with MongoDB compatibility

Google announced QueryData support for Firestore with MongoDB compatibility on October 12, 2026. Google says the feature lets developers build data agents that query database content through conversational language. Its documentation says QueryData translates natural-language questions into MongoDB-compatible Query Language (MQL) queries, using developer-supplied context sets with database-specific information. The feature is in preview, with potentially limited support.

Firebase

Backend

KrakenD releases Enterprise 2.13.11 security backport and Community and Enterprise 3.0.1

KrakenD released Enterprise Edition 2.13.11 as a recommended security backport on October 13, 2026, according to its changelog. The changelog also lists Community and Enterprise Edition 3.0.1 releases that day. It says the backport upgrades Go to 1.26.9 and updates amqp and OpenTelemetry dependencies for listed security issues. According to Red Hat, CVE-2026-97032 lets an unauthenticated remote attacker crash Go’s HTTP/2 server if they win an HPACK encoder race. KrakenD says affected versions are exposed when the gateway accepts HTTP/2 through Transport Layer Security negotiation or use_h2c.

KrakenD