SAP Cloud SDK for Python hit by CVSS 10.0 SSRF flaw

CVE-2026-89111 in the SAP Cloud SDK for Python below version 0.45.2 is a server-side request forgery flaw that can redirect OAuth2 tenant credentials to an attacker-chosen host. It carries a CVSS score of 10.0; no in-the-wild exploitation has been observed. The fix ships in version 0.45.2.

• CVE-2026-89111 carries a maximum CVSS score of 10.0
• SAP Cloud SDK for Python versions below 0.45.2 are affected
• The SSRF can leak OAuth2 credentials in multi-tenant BTP setups
• No in-the-wild exploitation observed at disclosure time