CVE-2026-89111: CWE-918: Server-Side Request Forgery in SAP_SE SAP Cloud

The SAP Cloud SDK for Python contains an SSRF vulnerability (CWE-918) that impacts multi-tenant SAP Business Technology Platform (BTP) applications. An attacker who can manipulate the tenant_subdomain parameter can cause OAuth2 token requests to be redirected to a malicious server. This redirection enables the attacker to capture client credentials, potentially compromising authentication and authorization mechanisms. The vulnerability is publicly disclosed with a CVSS 3.1 score of 10, indicating critical severity. No patch or remediation details are currently available, and the affected versions are not specified.

Successful exploitation allows an unauthenticated attacker to redirect OAuth2 token requests to an attacker-controlled server, resulting in the exfiltration of client credentials. This compromises the confidentiality and integrity of authentication tokens, potentially enabling unauthorized access to SAP Cloud resources. The vulnerability does not impact availability. Given the critical CVSS score, the impact on confidentiality and integrity is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the tenant_subdomain parameter and validate or sanitize inputs to prevent manipulation. Monitor for unusual OAuth2 token request redirections and consider implementing network-level controls to block unauthorized outbound requests to unknown servers.