CVE-2026-89111

{
  "etk_id": "ETK-2026-1991",
  "cve_id": "CVE-2026-89111",
  "display_id": "CVE-2026-89111",
  "ghsa_id": "GHSA-m3j7-wp2j-mhc3",
  "euvd_id": "EUVD-2026-98193",
  "status": "published",
  "anchor_state": "anchored",
  "title": "OAuth token request SSRF in SAP Cloud SDK for Python",
  "summary": "Multi-tenant BTP applications using SAP Cloud SDK for Python are affected. An attacker able to control the tenant subdomain input may steer OAuth token requests to an untrusted server and obtain client credentials.",
  "mitigation": "Upgrade sap-cloud-sdk to 0.45.2 or later.",
  "vendor": "SAP_SE",
  "product": "SAP Cloud",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<0.45.2"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "0.45.2"
      ],
      "package_name": "sap-cloud-sdk",
      "purl": "pkg:pypi/sap-cloud-sdk"
    }
  ],
  "cwes": [
    918
  ],
  "cvss_score": 10,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
  "epss_score": 0.0027,
  "epss_percentile": 0.1866,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 14.0224732,
  "t0_at": "2026-10-13T00:24:28.269000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-13T00:24:28.269000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T00:24:28.269000+00:00",
      "url": "https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html"
    }
  }
}