A 10.0 in the toolkit for building agents
SAP has patched a vulnerability rated 10.0 on the CVSS scale in the Python SDK its customers use to build AI agents on its cloud platform.
CVE-2026-89111 appears in SAP’s October 2026 Security Patch Day as an “OAuth2 SSRF vulnerability in SAP Cloud SDK for Python”, affecting versions below 0.45.2. SAP rates it Critical, with a CVSS score of 10.0 — the top of the scale, which requires no privileges, no user interaction and a complete loss of confidentiality, integrity and availability.
It is tracked under the GitHub advisory GHSA-4mv3-jxxm-9cx2 rather than a numbered SAP note, which is how SAP handles its open-source libraries.
What the flaw does
The SDK is SAP’s official toolkit for building AI agents and Python applications against Business Technology Platform services, BleepingComputer reports.
The bug sits in how multi-tenant BTP applications resolve which tenant they are acting for. An attacker who controls the tenant_subdomain parameter can point the SDK’s OAuth2 token request at a server they run, and the client credentials go to that server instead of SAP’s.
That is a server-side request forgery used as a credential-theft primitive, and it needs no account on the target. The credentials it leaks are the application’s, not an end user’s — which in a multi-tenant deployment is the more valuable of the two.
What to do
Upgrade to 0.45.2 or later, then rebuild and redeploy; a patched dependency that has not been rebuilt into the running application is not a patched application.
Where that cannot happen immediately, the advisory’s interim guidance is to validate tenant_subdomain against an allowlist of registered tenant subdomains before passing it to any SDK call.
The rest of the patch day
SAP released 20 new items on 13 October — 16 security notes and four GitHub security advisories — plus two updates to previously published notes.
Three other entries scored 9.0 or above: CVE-2026-89110 in NetWeaver Visual Composer at 9.9, CVE-2026-89107 in S/4HANA’s substitution and validation rule management at 9.9, and CVE-2026-89108 in Manufacturing Integration and Intelligence at 9.1.
SAP does not report exploitation in the wild for CVE-2026-89111, and no public proof-of-concept has been confirmed.
Why this one is worth noticing
Most enterprise patch days are not AI news. This one is, because of where the bug sits: not in a model, not in an agent framework’s reasoning, but in the ordinary SDK plumbing that connects an agent to the systems it is supposed to act on.
Agent deployments inherit the security posture of the libraries underneath them, and those libraries are now being written and shipped at the pace of an AI product cycle rather than an enterprise one. A 10.0 in an agent-building SDK is the kind of finding that will recur, and the thing to watch is how quickly SAP’s customers rebuild — because for this class of flaw, the patch is only half the fix.
