OAuth2 SSRF vulnerability in SAP Cloud SDK for Python
CVSS score
10.0
EPSS probability
%0.3
Risk score
0.0
Published
6 d ago
Related Security News
Articles and analysis bulletins in which the press and security publications have covered this vulnerability:
SAP Patches Critical CVSS 10.0 Flaw in Cloud SDK for Python
SAP released its October 2026 security patch on Tuesday, October 13, delivering 22 new and updated security notes. Four of them address critical-severity vulnerabilities. The most severe is CVE-2026-89111, a maximum-rated flaw in the Cloud SDK for Python. Several of the bugs could allow attackers to invoke internal operations or execute code, which could lead to complete compromise of affected systems. SAP's patch day summary breaks the release down into 16 new security notes, four GitHub security advisories, and two updates to previously released notes. The company recommends that customers v
SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities
The bugs could allow attackers to invoke internal operations and execute code, completely compromising the system. The post SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities appeared first on SecurityWeek.
SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP's official Python client for BTP services. An attacker must be able to control the tenant subdomain,
Similar Vulnerabilities
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-89111"