SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python.
The SAP Python SDK is the official programmatic toolkit for developing AI agents and Python applications on the company's SAP Business Technology Platform (BTP) services.
Tracked as CVE-2026-89111, the maximum-severity vulnerability patched this month can be exploited by remote attackers without privileges to steal credentials.
Customers who can't immediately deploy the October 2026 SAP patches can temporarily mitigate the issue by using an allowlist to validate tenant_subdomain values.
"The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated," according to a Tuesday advisory.
"Consumer applications can mitigate the vulnerability by validating tenant_subdomain against a known allowlist of registered tenant subdomains before passing it to any SDK call."