SAP Cloud SDK CVE-2026-89111 OAuth2 SSRF critical vulnerability

SAP Cloud SDK for Python carries CVE-2026-89111, a server-side request forgery in the OAuth2 flow scored CVSS 10.0. The flaw lives in multi-tenant SAP Business Technology Platform applications where an attacker controlling a tenant can trigger unauthenticated SSRF through the SDK's OAuth2 handling. SAP published the fix through GitHub advisory GHSA-4mv3-jxxm-9cx2, and the original disclosure dates to 2026-10-14.

This is not a routine library bug. Multi-tenant BTP environments expose every tenant's backend to any other tenant's request path, so a successful SSRF lets the attacker pivot from tenant isolation into internal cloud endpoints, metadata services, or adjacent services behind the SDK. The event list carries no exploitation telemetry yet, but the unauthenticated scope and CVSS 10.0 mean any exposed SDK endpoint is a direct breach of tenant boundaries without credential prerequisites.

Defenders should upgrade to the patched release referenced in GHSA-4mv3-jxxm-9cx2 immediately and verify dependency manifests for sap-cloud-sdk-python. Network restrictions should block unexpected outbound connections from SDK hosts, since the SSRF relies on the SDK making requests the attacker defines. Hunting should focus on OAuth2 callback anomalies, unexpected internal IP targets in SDK logs, and any tenant-level access logs that predate 2026-10-14.

Watch for active exploitation telemetry and a vendor clarification on exactly which SDK versions are affected, since the advisory points to GHSA-4mv3-jxxm-9cx2 but does not enumerate fixed release tags.