Latest / The Digital Warfare Podcast
EP. 180: SAP CVSS 10 OAuth2 Flaw Could Hand Attackers Your Cloud Credentials
Summary
SAP has patched CVE-2026-89111, a maximum-severity CVSS 10.0 OAuth2 SSRF vulnerability in the SAP Cloud SDK for Python. The flaw affects multi-tenant SAP BTP applications and can allow a remote attacker to manipulate the tenant_subdomain parameter, redirect OAuth2 token requests, and potentially steal application client credentials.
The affected library versions are earlier than 0.45.2. Organizations should upgrade immediately, review OAuth activity, and rotate credentials if exposure is suspected. SAP also recommends allowlisting approved tenant subdomains as a temporary mitigation…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.