SAP Cloud SDK for Python SSRF leaks OAuth2 client secrets

CVE-2026-89111, rated 10.0, lets an attacker control the tenant_subdomain field in SAP Cloud SDK for Python and receive client_id and client_secret during the OAuth2 token fetch. The fix shipped in 0.45.2, but a regression in 0.53.0–0.55.0 reopened the flaw until 0.55.1.

• CVSS 10.0 SSRF in the OAuth2 flow sends client_secret to an attacker host
• Affected: versions below 0.45.2 and the 0.53.0–0.55.0 range
• A 0.53.0 regression reopened the flaw; fixed again in 0.55.1
• Published on SAP Security Patch Day, 13 October 2026