Affected Systems
SAP Cloud SDK for Python versions below 0.45.2, 0.53.0 through 0.55.0, and all 0.36.x releases. Affects multi-tenant applications on SAP Business Technology Platform (BTP) using the SDK for authentication. Specific modules impacted: Agent Gateway, Destination, and Document Management Service.
Exploitation Status
No active exploitation reported. Vulnerability disclosed by GitHub user SunandM. SAP advisory states no known attacks as of October 13, 2026. Flaw has been present since SDK's first release on March 16, 2026.
Business Impact
Attackers who control tenant subdomain values can redirect OAuth2 authentication requests to attacker-controlled servers, capturing client ID and client secret. Impact depends on permissions granted to the compromised client credentials within SAP BTP environment. Credential theft enables persistent unauthorized access to BTP services and tenant data. Multi-tenant SaaS applications on BTP are primary risk surface.
Urgency
🟠Within 24 hours
Recommended Actions
- Upgrade SAP Cloud SDK for Python to version 0.55.1 or later (0.58.4 was latest as of advisory date). Avoid versions 0.53.0-0.55.0 and all 0.36.x releases.
- If running versions 0.45.2-0.52.2, verify you are not using Destination or Document Management Service modules before deferring upgrade.
- Implement input validation: compare tenant subdomains against a whitelist of registered tenants before passing values to the SDK.
- Review application logs for anomalous token requests or authentication attempts to unexpected URLs since March 16, 2026.
- Rotate OAuth2 client credentials for any application that ran affected SDK versions in production, especially if tenant subdomains are user-controllable.