# SAP patches Python SDK flaw that can leak client credentials

_Published Tuesday, October 13, 2026 at 11:01 AM EDT · Security, Products · Latest · Tier 2 — Notable_

![SAP patches Python SDK flaw that can leak client credentials — Primary](https://www.bleepstatic.com/content/hl-images/2026/07/14/SAP.jpg)

SAP has patched 20 security flaws in its October updates, including a maximum-severity vulnerability that lets remote attackers without privileges steal credentials from applications using its Cloud SDK for Python. The toolkit supports AI agents and Python applications on SAP's Business Technology Platform.

The flaw, CVE-2026-89111, lets an attacker control the tenant_subdomain parameter and redirect OAuth2 token requests to an attacker-controlled server, leaking client credentials. Customers unable to patch immediately can validate that parameter against an allowlist of registered tenant subdomains.

SAP also patched critical access-control flaws in NetWeaver Visual Composer and Manufacturing Integration and Intelligence; those require limited privileges and administrator privileges, respectively.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severity-oauth2-ssrf-security-flaw/)

---
Canonical: https://techandbusiness.org/newswire/4F61fQXYAHQGvrShYrz-h_
Published: 2026-10-13T15:01:06.789Z
Story chronology: 2026-10-13T13:51:02.000Z
Retrieved: 2026-10-13T17:50:42.524Z
Publisher: Tech & Business (techandbusiness.org)