SAP released fixes for 20 security flaws on October 13, including a CVSS 10.0 OAuth2 server-side request forgery vulnerability in its Cloud SDK for Python. The flaw could let remote attackers without privileges redirect token requests and steal credentials from affected multi-tenant applications.
October 13 Patch Day
SAP’s October security release includes 16 new security notes and four GitHub security advisories, along with updates to two previously issued notes. The company’s official October 2026 Security Patch Day bulletin identifies the Cloud SDK issue as CVE-2026-89111.
SAP publishes security corrections on the second Tuesday of each month. Its general Security Notes and News page lists October 13 as a 2026 patch-day date and explains how the company categorizes security notes and support-package fixes.
OAuth2 Flaw Steals Credentials
The Cloud SDK for Python vulnerability affects versions earlier than 0.45.2 and carries a CVSS score of 10.0. SAP says an attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, potentially exposing client credentials.
The project’s official GitHub repository describes the package as SAP’s Python client for SAP Business Technology Platform services. The repository also directs security reports to SAP’s disclosure process rather than its public issue tracker.
Critical SAP Products Affected
The same patch release fixes CVE-2026-89110, a CVSS 9.9 broken-access-control vulnerability in SAP NetWeaver Visual Composer, and CVE-2026-89107, a CVSS 9.9 code-injection vulnerability in SAP S/4HANA’s Manage Substitution/Validation Rules product.
SAP also lists a CVSS 9.1 missing-authorization vulnerability in Manufacturing Integration and Intelligence, plus a CVSS 8.8 SQL-injection issue in SAP Commerce Cloud. The affected versions and product-specific security notes are listed in SAP’s official bulletin.
Official Versions and Guidance
SAP’s bulletin identifies the Cloud SDK versions below 0.45.2 as affected and says the October fixes are intended to remediate vulnerabilities in customer SAP landscapes. SAP strongly recommends that customers consult its support portal and prioritize the applicable patches.
References
Gatlan, S. (2026, October 13). SAP warns of maximum severity OAuth2 SSRF security flaw. BleepingComputer. https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severity-oauth2-ssrf-security-flaw/
SAP. (2026, October 13). SAP Security Patch Day – October 2026. https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2026.html
SAP. (2026). SAP Cloud SDK for Python. GitHub. https://github.com/SAP/cloud-sdk-python