SAP Cloud SDK for Python CVE-2026-89111 / GHSA-4mv3-jxxm-9cx2 (CVSS 10) OAuth2 SSRF leaks client credentials: which sap-cloud-sdk version fixes it?

Am I affected: you may be if a Python app uses the sap-cloud-sdk package (SAP Cloud SDK for Python) in an affected version: 0.1.0 up to but not including 0.45.2, or 0.53.0 up to but not including 0.55.1. The flaw is a server-side request forgery in OAuth2 token requests. If an attacker can influence the tenant_subdomain value your app passes to the SDK, for example from a request header, URL or multi-tenant routing input, the token request can be sent to a server they control. That leaks your OAuth2 client ID and client secret. SAP published the advisory on October 13, 2026 with its October patch day. Coverage at that time did not report active exploitation. How to check: - pip show sap-cloud-sdk (or check requirements/lockfiles and container images) - Search your code for where tenant_subdomain is set, and whether any part of it comes from user-controlled input. Fix: upgrade sap-cloud-sdk to 0.55.1 or later. If you are on the older line, 0.45.2 or later also has the fix, but versions 0.53.0 to 0.55.0 are affected again, so don't stop partway. Interim mitigation (SAP's guidance): before passing tenant_subdomain to any SDK call, check it against an allow-list of your registered tenant subdomains and reject anything else. After patching: if a vulnerable version handled user-influenced tenant values, assume the OAuth2 client credentials may have leaked. Rotate the client secret / service key in SAP BTP, and review service usage and audit logs for token requests or API calls you don't recognize. Sources: https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severity-oauth2-ssrf-security-flaw/ https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html https://github.com/advisories/GHSA-4mv3-jxxm-9cx2