SAP warns of maximum severity OAuth2 SSRF security flaw (www.bleepingcomputer.com)

SAP has identified and patched a maximum-severity OAuth2 Server-Side Request Forgery (SSRF) vulnerability in its Cloud SDK for Python, critical for building AI agents on the SAP Business Technology Platform. Designated as CVE-2026-89111, this flaw allows remote attackers to exploit the `tenant_subdomain` parameter, redirecting OAuth2 token requests to unauthorized servers, potentially leading to credential theft. To mitigate the issue temporarily, customers are advised to use an allowlist for validating tenant subdomains before making SDK calls. This announcement is particularly significant for the AI and ML community as the SAP Cloud SDK is pivotal in deploying AI applications within SAP’s ecosystem, which serves many of the world’s largest enterprises. With a history of maximum-severity vulnerabilities, SAP's recent updates highlight urgent security concerns in the rapidly evolving landscape of cloud-based AI solutions. The ongoing risks emphasized by security experts, coupled with the increasing rate of exploits targeting SAP systems, underscore the need for robust security measures and awareness among developers and organizations utilizing these technologies.