Six SAP Cloud SDK for Python releases skip the check added in August to stop credential leaks
SAP rated CVE-2026-89111, an OAuth2 credential leak in its Cloud SDK for Python, CVSS 10.0 in an October 13 advisory. The Hacker News found that six later releases, 0.53.0 through 0.55.0, skip the August fix in the Destination module.
The Watch · Security desk
Share figure from The Hacker News: of the 11 tests SAP added for the check, the six releases failed 9. The tests were run on October 13 against the source code of each release.
- Tests failed by the six releases, claim 8 9 of 11 tests SAP added 82% computed
Tests failed by the six releases The rest of the 11
| Share | Part | Whole | Percent | Claim |
|---|---|---|---|---|
| Tests failed by the six releases | 9 tests SAP added | 11 tests SAP added | 82% (computed) | 8 |
What happened
- The August fix added a check that accepts only a single name of letters, digits and hyphens, up to 63 characters, and rejects every other tenant subdomain.
- Version 0.53.0 moved the Destination module onto new shared token-request code that omitted the check, and 0.55.1 restored it there on September 18.
- On October 13 The Hacker News ran SAP's own tests on each release's source: the six failed 9 of 11, while 0.55.1 and the next 11 releases cleared the whole set.
- On October 13 the advisory still marked nothing above 0.45.2 as affected, and neither it nor the release notes say whether the six releases fall under the CVE.
- SAP's August release notes filed the fix under Bug Fixes without mentioning security, and the advisory followed 53 days later.
Why it matters
- exposure A dependency check keyed to the advisory's range of versions below 0.45.2 clears all six releases, so teams on 0.53.0 through 0.55.0 get no warning from it.
- constraint Teams on the 0.36 line cannot patch in place. None of its three releases has the check, so they have to move to 0.45.2 or later.
- decision Whether to rotate client secrets is each team's call. The advisory gives no guidance for applications that ran an unchecked release.
The leak needs two conditions. An application has to pass a tenant subdomain to the SDK [13], and an attacker has to control that value [3]. When a subdomain arrives, the SDK takes the token URL from the application's configuration and replaces part of it with the subdomain [15]. Releases without the check used whatever value they were given and sent the client ID and client secret to the resulting URL [15]. According to SAP, an attacker who controls the subdomain can point that request at their own server [19]. What the attacker can then do with the credentials depends on what the application's client is allowed to do [20]. The unchecked code has been in the SDK since its first PyPI release on March 16 [16].
The 0.55.1 release notes describe the restored behavior. Passing a tenant subdomain that contains URL delimiters "now raises ValueError immediately instead of silently routing credentials to an attacker-controlled endpoint," the notes say [7]. The August fix covered three modules: Agent Gateway, Destination and Document Management Service [21]. The Hacker News traced the later gap to Destination [5].
The evidence for the six releases is a test run against source code [8]. The advisory reports no attacks and credits a GitHub user named SunandM with the report [18]. The August notes described the underlying problem only as a malformed URL: "Previously, invalid values were silently used to construct a malformed URL," they say [22].
Counting the 0.36 line, eight releases published after the August 21 fix lack the check in at least some cases [23]. In our view, teams on 0.53.0 through 0.55.0 should treat the Destination module as exposed wherever they pass it a tenant subdomain. The missing check is the one the advisory is about.
The check is present in 0.45.2 through 0.52.2 and again in 0.55.1 through 0.58.4, and 0.58.4 was the newest release on PyPI on October 13 [11]. Where an upgrade is not possible yet, the advisory says a team can screen each tenant subdomain against its own list of registered tenants before the value reaches the SDK [12].
What to watch
- Whether SAP revises the advisory to list 0.53.0 through 0.55.0 as affected or says they fall outside CVE-2026-89111.
- Whether SAP issues guidance on rotating client credentials for applications that ran an unchecked release.
- Any report of attacks using the flaw, since the advisory reports none as of October 13.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence74
- Adoption
- Insufficient
- Hype gap−15
- Incentives
- Insufficient
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
SAP said in a security advisory on October 13 that a flaw in its Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls.
- [2]
The flaw is tracked as CVE-2026-89111 and carries SAP's CVSS score of 10.0; the advisory names version 0.45.2, released August 21, as the fix.
- [3]
The flaw affects multi-tenant applications on SAP Business Technology Platform that use the SDK, and an attacker must be able to control the tenant subdomain.
- [4]
Version 0.45.2 added a check that accepts only a single name made of letters, digits and hyphens, up to 63 characters long; any other tenant subdomain stops the request with an error.
- [5]
Six releases, versions 0.53.0 through 0.55.0, published between September 10 and September 18, skip the check when an application calls the SDK's Destination service module.
- [6]
Version 0.53.0 moved the Destination module onto new shared code for requesting tokens, and that code did not include the check; version 0.55.1 added it there on September 18.
- [7]
Passing a tenant subdomain that contains URL delimiters "now raises ValueError immediately instead of silently routing credentials to an attacker-controlled endpoint," the 0.55.1 release notes say.
- [8]
The Hacker News ran SAP's own tests for the check on October 13 against the source code of every release from 0.45.1 to 0.58.4 and of the three 0.36 releases; the six releases failed 9 of the 11 tests SAP added with 0.55.1, while 0.55.1 and the 11 releases after it passed all 11.
- [9]
As of October 13, the advisory lists no version above 0.45.2 as affected, and neither it nor the release notes say whether the six releases fall under CVE-2026-89111.
- [10]
Versions 0.36.1 and 0.36.2, published September 4 and September 10, also lack the check and fall inside the advisory's range of versions below 0.45.2; none of the three 0.36 releases contains the check, so upgrading within that line does not add it.
- [11]
Versions 0.45.2 through 0.52.2 and 0.55.1 through 0.58.4 contain the check; version 0.58.4 was the newest release on PyPI on October 13.
- [12]
Applications that cannot upgrade yet can compare each tenant subdomain with a list of their registered tenants before passing it to the SDK, SAP says in the advisory.
- [13]
The flaw matters only where an application passes a tenant subdomain to the SDK.
- [14]
The advisory does not say whether applications that ran a release without the check should replace their client credentials.
- [15]
When an application passes a tenant subdomain, the SDK takes the token URL from the application's configuration and replaces part of it with the subdomain; releases without the check used whatever value they were given and sent the client ID and client secret to the resulting URL.
- [16]
The unchecked code was in the SDK from its first release on PyPI, on March 16.
- [17]
The August release notes list the fix under "Bug Fixes" and do not mention security; the advisory followed 53 days later.
- [18]
The advisory credits a GitHub user named SunandM with reporting the flaw and does not report any attacks.
- [19]
An attacker who controls the tenant subdomain can point the token request at their own server, according to SAP.
- [20]
What an attacker could do with the credentials depends on what the application's client is allowed to do.
- [21]
The August fix covered three modules: Agent Gateway, Destination and Document Management Service.
- [22]
"Previously, invalid values were silently used to construct a malformed URL," the August release notes say.
- [23]
Eight releases published after the August 21 fix lack the check in at least some cases: the six in 0.53.0 through 0.55.0 plus 0.36.1 and 0.36.2.
- [24]
Every version from 0.53.0 through 0.55.0 is above 0.45.2, so a dependency check against the advisory's affected range of versions below 0.45.2 returns not affected for all six.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- thehackernews.comSAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Server-Side Request ForgeryFollow
- OAuth credential securityFollow
- Software vulnerabilitiesFollow
- Software supply chain riskFollow