CVE-2026-89111

CriticalCVSS 10.0/10Last modified Oct 15, 2026

Description

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-891126.5The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the targe CVE-2026-891138.8SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authentica CVE-2026-891165.9The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to CVE-2026-891176.1SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflect CVE-2026-891185.3SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application info CVE-2026-89127.5The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'form_input' parameter in versions up to, and including, 28.CVE-2026-891207.1A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be CVE-2026-891214.7SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business objec CVE-2026-891226.1SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft CVE-2026-891244.3Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionali CVE-2026-89138.5A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v5 due to improper neutralization of user-con CVE-2026-891335.3wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstrain