CVE-2026-89111: SSRF in a Multi-Tenant SDK and the OAuth Credentials Behind It

A server-side request forgery in a cloud SDK sounds like a lower-tier finding until you consider what the SDK is holding. For CVE-2026-89111 in the SAP Cloud SDK for Python, the answer is OAuth2 client credentials in multi-tenant SAP Business Technology Platform environments.

The disclosure

CVE-2026-89111 is rated 10.0 and affects SAP Cloud SDK for Python versions below 0.45.2. The flaw is server-side request forgery. Public reporting reviewed here notes that no in-the-wild exploitation had been observed at the time of writing, which distinguishes it from the KEV-listed issues covered elsewhere in this series.

Severity without exploitation is still severity.…