SAP has released 22 new and updated security notes, four of them critical, led by a maximum-severity flaw in its Cloud SDK for Python.
Tracked as CVE-2026-89111 and rated 10 out of 10, the bug is a server-side request forgery issue in the SDK’s OAuth2 handling. It affects multi-tenant applications built on SAP’s Business Technology Platform.
The problem sits in the tenant_subdomain parameter. An attacker who can control that value can redirect requests to an internal endpoint and pull out OAuth2 credentials, which in turn opens the door to stealing tokens or reaching services that should never be exposed to the public internet.
Because the SDK is a library rather than a hosted product, the fix has to be applied by the developers who ship applications on top of it. SAP’s note covers the affected versions and the corrected release, and administrators should treat any Python application that uses the SDK against a multi-tenant BTP setup as in scope.
The same patch cycle addressed critical issues in NetWeaver, S/4HANA, and Manufacturing Integration and Intelligence. SAP said the bugs could allow attackers to invoke internal operations and execute code, effectively compromising the affected system.
Enterprises running SAP should review the full set of October notes rather than cherry-picking. Notes that touch authentication and cryptographic handling often ship alongside the CVSS 10 headline item, and leaving one unapplied can undercut the rest.
