SAP's October 2026 security updates, published 13 October, cover 20 flaws. The headline item is CVE-2026-89111, a CVSS 10.0 server-side request forgery in the SAP Cloud SDK for Python. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to a server they control and steal client credentials.
What happened
The SDK is the official toolkit for Python applications and AI agents on SAP Business Technology Platform. The bug hits multi-tenant BTP applications that pass a caller-supplied tenant subdomain into an SDK call. SAP scores it critical: network, no privileges, no user interaction, changed scope, high confidentiality and integrity. Versions of sap-cloud-sdk before 0.45.2 are affected. There is no public report that this specific flaw is being exploited.
The same patch day also fixes CVE-2026-89110, a broken access-control bug in SAP NetWeaver Visual Composer, and CVE-2026-89108 in SAP Manufacturing Integration and Intelligence.
Who is affected
- Applications built on SAP Cloud SDK for Python below 0.45.2
- Multi-tenant BTP apps that pass tenant_subdomain into SDK OAuth2 calls
- Teams that cannot patch immediately and have not allowlisted tenant subdomains
What to do now
Upgrade the SAP Cloud SDK for Python to 0.45.2 or later, and until that ships, validate tenant_subdomain against a known allowlist of registered tenant subdomains before any SDK call. Rotate client credentials for any multi-tenant app that accepted untrusted subdomain input. Do not treat the allowlist as a permanent fix.
Source: BleepingComputer, SAP OAuth2 SSRF. Vendor record: CVE-2026-89111.
Also on the blog
- Ivanti Connect Secure CVE-2026-104935 zero-day, CVSS 8.6
- GitLab CVE-2026-97229: CVSS 10.0 unauthenticated RCE
- AhsayCBS CVE-2026-105134: SYSTEM RCE, 5 organizations hit
- LG webOS local-network root chain, no PIN required
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.