SAP Patches Critical OAuth2 Credential Theft Flaw as Later SDK Releases Show Fix Regression

SAP released 22 new and updated security notes for its October Security Patch Day, addressing four critical vulnerabilities, including CVE-2026-89111, a CVSS 10.0 server-side request forgery flaw in SAP Cloud SDK for Python. An attacker controlling the tenant subdomain passed to the SDK can expose an application's OAuth2 client ID and client secret, putting multi-tenant SAP BTP applications at risk. SAP identified version 0.45.2 as the fix, but The Hacker News found that six subsequent releases spanning 0.53.0 through 0.55.0 lacked the validation for Destination service calls; 0.55.0 also lacked it for Document Management Service calls. Version 0.55.1 restored the check, which testing confirmed remained present through 0.58.4. SAP's advisory did not list the regressed releases as affected or clarify whether the same CVE covers them.

The other critical fixes address NetWeaver Visual Composer and S/4HANA flaws that can let low-privileged or specially authorized attackers invoke internal operations or execute arbitrary ABAP code, and a Manufacturing Integration and Intelligence flaw allowing users with XMII Admin privileges to create an administrator account on the underlying Java application server. SAP also patched high-severity issues in Commerce Cloud, NetWeaver, and ABAP Platform and urged prompt updates. Organizations using Cloud SDK for Python should verify that their deployed release contains the restored validation rather than relying solely on the originally named fixed version. Where upgrading is not possible, SAP recommends validating tenant subdomains against registered tenants. SAP reported no attacks involving the SDK flaw and made no mention of exploitation of the other patched vulnerabilities.