SAP says it has fixed 20 security flaws across multiple products in its October 2026 security updates. The release includes a maximum-severity server-side request forgery (SSRF) flaw in the Cloud SDK for Python, tracked as CVE-2026-89111.
The SAP Python SDK is the company’s official toolkit for building AI agents and Python applications on SAP Business Technology Platform (BTP) services. According to SAP’s advisory, an attacker who controls the tenant_subdomain parameter could redirect OAuth2 token requests to a server they control, exposing client credentials. The flaw affects multi-tenant BTP applications and can be exploited remotely without privileges.
SAP recommends that consumer applications validate tenant_subdomain against an allowlist of registered tenant subdomains before passing it to an SDK call. This can temporarily mitigate the issue for customers unable to deploy the October 2026 patches immediately.
The updates also address CVE-2026-89110, a critical broken access control flaw in SAP NetWeaver Visual Composer that could allow remote attackers with limited privileges to compromise vulnerable systems. A separate critical flaw, CVE-2026-89108, affects SAP Manufacturing Integration and Intelligence. It could let attackers with administrator privileges gain control of the underlying system by creating an elevated-privilege account on its Java application.
Comments
0No comments yet. Be the first to comment.