SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft

Summary: SAP disclosed on October 13 that a flaw in its Cloud SDK for Python, tracked as CVE-2026-89111 with a CVSS score of 10.0, can send an application's OAuth2 client ID and client secret to an attacker-controlled server when the application passes a tenant subdomain the attacker controls. SAP's fix in version 0.45.2, released August 21, added a check that rejects any tenant subdomain that is not a simple name, but The Hacker News found six later releases (0.53.0 through 0.55.0) skip that check in the Destination service module, and versions 0.36.1 and 0.36.2 also lack it.
Bottom line: The unchecked code shipped in the SDK from its first PyPI release on March 16, and the August fix was listed only under "Bug Fixes" with no mention of security, so teams that upgraded on the assumption they were covered may still be running releases that failed 9 of SAP's 11 tests. The advisory does not say whether applications that ran a release without the check should replace their client credentials.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-89111
Related: ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026