---
title: SAP October Patch Day: CVSS 10.0 OAuth2 SSRF in Cloud SDK for Python (CVE-2026-89111) | ctxsec
url: https://ctxsec.com/items/sap-oct-2026-89111
description: ""
status: "confirmed (vendor)"
published: 2026-10-13
---

> 

[← Cybersecurity News](/news) · [markdown](/items/sap-oct-2026-89111.md)

confirmed (vendor)

2026-10-13

### SAP October Patch Day: CVSS 10.0 OAuth2 SSRF in Cloud SDK for Python (CVE-2026-89111)

SAP's Oct 13 Security Patch Day ships 16 new notes and 4 GitHub advisories. Highest severity: CVE-2026-89111 (CVSS 10.0) in SAP Cloud SDK for Python <0.45.2 — attacker-controlled `tenant_subdomain` can redirect OAuth2 token requests and exfiltrate client credentials in multi-tenant BTP apps. Fix: upgrade to 0.45.2+; workaround: allowlist tenant subdomains. Also Critical: NetWeaver Visual Composer broken access control (CVE-2026-89110, 9.9) and S/4HANA Manage Substitution/Validation Rules code injection (CVE-2026-89107, 9.9).

Sources: [SAP Security Patch Day — October 2026](https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2026.html) · [GitHub advisory GHSA-4mv3-jxxm-9cx2](https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-4mv3-jxxm-9cx2) · [CVE-2026-89111](https://www.cve.org/CVERecord?id=CVE-2026-89111)