CVE-2026-89111

Executive Summary

The SAP Cloud SDK for Python contains an OAuth2 server-side request forgery (SSRF) vulnerability (CWE-918) affecting multi-tenant SAP Business Technology Platform (BTP) applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing the SDK's OAuth2 client credentials to be exfiltrated. With a CVSS base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), the flaw is remotely exploitable without authentication or user interaction and yields high confidentiality and integrity impact across a changed security scope; no public exploit, PoC, or CISA KEV entry exists as of this report.

Technical Analysis

The vulnerability is a server-side request forgery (SSRF) classified under CWE-918 that manifests in the OAuth2 request-construction flow of the SAP Cloud SDK for Python. The SDK is designed for multi-tenant BTP applications, where a tenant is identified by a subdomain component (tenant_subdomain). Per the available description, the SDK constructs OAuth2 token-request URLs using tenant-related data, and that data is attacker-influenceable via the tenant_subdomain parameter.

When an attacker controls tenant_subdomain, the SDK can be induced to direct its OAuth2 token request to an attacker-controlled host rather than the legitimate SAP authorization server. Because the token request is an outbound server-side request issued by the application itself, the attacker effectively weaponizes the server as a request proxy. Critically, the request is an OAuth2 client-credentials request, which by design carries the application's own client credentials (client ID and secret). Redirecting such a request to an attacker endpoint therefore discloses those credentials to the attacker.

The core weakness is the absence of outbound host validation (allowlisting) on the token endpoint derived from tenant input. A robust OAuth2 client should pin the authorization/token endpoint to a fixed, trusted host or validate any derived host against a strict allowlist. Here, the tenant-derived subdomain appears to be concatenated or interpolated into the token endpoint, enabling host redirection. Because the security scope is marked as Changed (S:C), the exploit affects resources beyond the vulnerable component's own security authority — consistent with an SSRF where the vulnerable application's network position and credentials are leveraged against external systems.

No function names, class names, endpoints, or internal parameters beyond tenant_subdomain are provided in the source data; accordingly, the specific code construction path cannot be detailed without fabrication. No public PoC, Nuclei template, or exploit code exists.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the SSRF vulnerability class and the OAuth2 credential-exfiltration mechanism described in the source data.

1. Reconnaissance / target identification. The attacker identifies a multi-tenant application built on the SAP Cloud SDK for Python that exposes tenant selection to untrusted input — for example, a login flow, tenant-routing mechanism, or API path from which the tenant_subdomain value is derived. Attackers enumerate BTP-hosted applications and probe for inputs that influence the tenant subdomain used in backend OAuth2 requests.

2. Triggering the flaw. The attacker sets or influences the tenant_subdomain parameter to a value that causes the SDK to resolve the OAuth2 token endpoint to an attacker-controlled domain (e.g., by pointing the subdomain at a host the attacker owns). The vulnerable SDK constructs the token request URL from this untrusted value and initiates the outbound request.

3. Payload / execution (vulnerability-class level). The application's OAuth2 client sends a client-credentials token request — including its client credentials — to the attacker-controlled endpoint. The attacker's server receives the request, capturing the client credentials. No memory-corruption or code-injection primitive is involved; the exploit is purely a request redirection leveraged through a trusted server-side flow.

4. Post-exploitation impact. With the exfiltrated OAuth2 client credentials, the attacker can authenticate to the legitimate authorization server as the affected application. Depending on the granted OAuth2 scopes, this enables unauthorized access to downstream BTP services and data, potentially masquerading as the trusted application (integrity impact) and reading or modifying protected resources (confidentiality/integrity impact). Because scope is changed, pivoting beyond the vulnerable app's own authority into connected services is plausible.

Impact Assessment

CVSS 3.1 base score: 10.0 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N.

• Attack Vector (N): Exploitable over a network.
• Attack Complexity (L): No specialized conditions required.
• Privileges Required (N): No authentication needed prior to exploitation.
• User Interaction (N): No victim interaction required.
• Scope (C): Impact extends beyond the vulnerable component's security authority — credential theft enables lateral impact across services.
• Confidentiality (H): OAuth2 client credentials and any resources reachable with them may be fully disclosed.
• Integrity (H): Stolen credentials permit unauthorized modifications via the trusted application's identity.
• Availability (N): No direct availability impact.

Blast radius: Any multi-tenant BTP application that uses the affected SAP Cloud SDK for Python and derives OAuth2 token endpoints from the tenant_subdomain parameter. In a multi-tenant model, a single exploitable tenant-facing input could expose shared backend credentials (if credentials are not strictly per-tenant), making cross-tenant exposure a serious concern. Business impact includes unauthorized access to SAP BTP services, data theft, fraudulent operations under the application's identity, and potential downstream supply/trust-chain exposure. Because no affected-version range or vendor fix is available, all deployments should be treated as potentially vulnerable until validated.

Detection Guidance

Sigma Rule

title: Potential SAP Cloud SDK OAuth2 SSRF via tenant_subdomain Manipulation
id: 7f3c1a2e-9b64-4d1e-8a21-0c5e2f4b9a10
status: experimental
description: Detects requests that manipulate the tenant_subdomain parameter, indicating possible SSRF against SAP Cloud SDK for Python OAuth2 token flows.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-89111
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - attack.t1552
logsource:
  category: webserver
  product: generic
detection:
  selection_param:
    cs-uri-query|contains:
      - 'tenant_subdomain='
  selection_anomaly:
    cs-uri-query|contains:
      - '://'
      - 'tenant_subdomain=http'
      - 'tenant_subdomain=//'
      - 'tenant_subdomain=@'
  condition: selection_param and selection_anomaly
falsepositives:
  - Legitimate tenants with unusual naming conventions
level: high

YARA Rule

rule CVE_2026_89111_SAP_CloudSDK_OAuth2_SSRF
{
    meta:
        description = "Detects tenant_subdomain manipulation patterns associated with SAP Cloud SDK for Python OAuth2 SSRF (CVE-2026-89111)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-89111"
        severity = "critical"

    strings:
        $p1 = "tenant_subdomain" ascii nocase
        $u1 = "tenant_subdomain=http" ascii nocase
        $u2 = "tenant_subdomain=//" ascii nocase
        $u3 = "tenant_subdomain=@" ascii nocase
        $o1 = "oauth" ascii nocase
        $t1 = "token" ascii nocase

    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0A3C or
        (any of ($p1) and 1 of ($u*) ) or
        ($p1 and any of ($o1, $t1))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-89111 SAP Cloud SDK OAuth2 SSRF via tenant_subdomain"; flow:established,to_server; http.uri; content:"tenant_subdomain="; nocase; pcre:"/tenant_subdomain=(?:https?:)?\/\/|tenant_subdomain=[^&]*@/i"; classtype:attempted-recon; sid:202689111; rev:1; reference:cve,2026-89111; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where url.query contains "tenant_subdomain=" and url.query regex ".*tenant_subdomain=(https?:)?//.*" ]
  [ network where url.query contains "oauth" and network.direction == "egress" ]

Splunk SPL Query

index=web OR index=proxy
| eval q=coalesce(uri_query, url_query, cs_uri_query, request_url)
| where like(lower(q), "%tenant_subdomain=%")
| where match(lower(q), "tenant_subdomain=(https?:)?//") OR match(lower(q), "tenant_subdomain=[^&]*@")
| stats count min(_time) as first_seen max(_time) as last_seen values(q) as queries by src_ip, dest_host
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,appattack,cve-2026-89111,">
  <rule id="2026891" level="12">
    <if_sid>31100</if_sid>
    <url>tenant_subdomain=</url>
    <regex>tenant_subdomain=(https?:)?//|tenant_subdomain=[^&amp;]*@</regex>
    <description>CVE-2026-89111: Possible SAP Cloud SDK OAuth2 SSRF via tenant_subdomain manipulation</description>
    <mitre>
      <id>T1190</id>
      <id>T1552</id>
    </mitre>
    <group>cve_2026_89111,ssrf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No fixed version, vendor workaround, or affected-version range is available.

1. Immediate mitigations

   • Treat the tenant_subdomain parameter as untrusted. Where possible, validate it strictly against an allowlist of known tenant identifiers and reject any value containing URL schemes (http://, https://), path separators, @, or slashes.
   • Pin OAuth2 token endpoints to a fixed, trusted host. Do not derive the token endpoint host from tenant-supplied input; if tenant-specific endpoints are required, resolve them from a server-side mapping rather than from client input.
   • At the network layer, restrict outbound egress from BTP application runtimes so the application can only reach sanctioned SAP authorization endpoints, blocking connections to arbitrary external hosts.
   • Rotate any OAuth2 client credentials that may have been exposed, and audit authorization-server logs for token requests originating from unexpected sources.

2. Patch/upgrade steps

   • Monitor the SAP Cloud SDK for Python release channels and SAP security notes for a fix referencing CVE-2026-89111. No patched version is currently identified.
   • Since no fixed version exists, plan to upgrade immediately once SAP publishes an advisory or patched release. Validate the installed SDK version against the eventual vendor advisory.

3. Long-term hardening

   • Adopt secure-by-design OAuth2 client configuration: allowlist token endpoint hosts and validate redirect/token URLs before issuing requests.
   • Enforce strict input validation and normalization for all tenant-identifying inputs across multi-tenant boundaries.
   • Implement egress filtering and DNS allowlisting for application runtimes to reduce SSRF blast radius.
   • Add logging and alerting on outbound auth requests to non-sanctioned hosts, and periodically review per-tenant credential separation to contain cross-tenant exposure.

References

• NVD — CVE-2026-89111: https://nvd.nist.gov/vuln/detail/CVE-2026-89111
• CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• MITRE ATT&CK T1552 — Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
• SAP Product Security — Security Notes and Advisories: https://www.sap.com/about/trust-center/security/incident-management.html

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-89111 as of this report; the CVE is not listed in CISA KEV, and no public PoC, Nuclei template, or exploit code has been observed.