[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZelS-aqoT2X3yyQzlJcgVve1TvbzBd7xaHw0jzay24c":3},{"article":4,"iocs":46,"watch_terms":51,"solutions":52,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"b1a55a1f-172b-4cd5-bd58-838ff49d3864","SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft","sap-discloses-critical-cvss-10-flaw-in-cloud-sdk-for-python-allowing-oauth2-cred-9f98c6","A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP's official Python client for BTP services. An attacker must be able to control the tenant subdomain,","SAP has disclosed a critical vulnerability (CVSS 10.0) in its Cloud SDK for Python, allowing attackers to steal OAuth2 client credentials. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK. An attacker can exploit this by controlling the tenant subdomain to redirect credential requests to their own server. SAP released version 0.45.2 with a fix, but later versions (0.53.0-0.55.0) inadvertently reintroduced the vulnerability in certain modules before it was fully patched in 0.55.1.","SAP Cloud SDK for Python has critical CVSS 10 flaw allowing OAuth2 credential theft.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fsap-discloses-critical-cvss-10-flaw-in.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgKBZR5elkBVKRcFO6lyde7XYDVO73IBxDvnx9-UkLst3GhVFuK8Yz3QBVIIEJABDjZuJMn8tyf7RLLPIRV8J8qe-OUULjnQRaQNyWricSsOjlKJoyYu8WOvs5PxBWQpzuiq8hlDlOY7zY-qIYDgQ6NFuifS5GbHbnLBET0OTfmsMC8797Mo5un9_ECyg8\u002Fs1600\u002Fsap-hacker.jpg","2026-10-13T17:28:50+00:00","2026-10-13T20:00:20.499827+00:00",9,[17,20,23,26],{"name":18,"type":19},"Cloud SDK for Python","product",{"name":21,"type":22},"SAP","vendor",{"name":24,"type":25},"OAuth2","technology",{"name":27,"type":19},"SAP Business Technology Platform (BTP)","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,41],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[47],{"type":48,"value":49,"context":50},"cve","CVE-2026-89111","SAP Cloud SDK for Python critical vulnerability",[21,18,27],{"controls":53,"vendors":137},[54,83,108],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":84,"name":85,"problem":86,"products":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",[88,92,100],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":84,"product_name":89,"url":90,"description":91},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":109,"name":110,"problem":111,"products":112},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":153},"sap-cloud-sdk-flaw-exposes-oauth2-credentials-due-to-patch-regression","SAP Cloud SDK Flaw Exposes OAuth2 Credentials Due to Patch Regression","A critical CVSS 10.0 vulnerability in SAP's Cloud SDK for Python allowed attackers to hijack OAuth2 client credentials by manipulating tenant subdomains to redirect authentication requests to malicious servers. What makes this incident particularly serious is that SAP initially patched the flaw in version 0.45.2, but a patch regression inadvertently reintroduced the vulnerability in versions 0.53.0 through 0.55.0 — meaning organizations that updated their software believed they were protected when they were not. This highlights two compounding risks: the danger of OAuth2 credential theft in multi-tenant cloud environments, and the often-overlooked hazard of regression bugs in security patches. Stolen OAuth2 credentials can grant attackers persistent, broad access to cloud resources, potentially affecting all tenants of a compromised application. Organizations must treat patch validation and regression testing as a core part of their vulnerability management lifecycle, not an afterthought.",[143,144,145,146,147,148,149,150,151,152],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 16 – Application Software Security","NIST SP 800-53 SI-2 (Flaw Remediation)","NIST SP 800-53 IA-2 (Identification and Authentication)","NIST SP 800-53 AC-17 (Remote Access)","NIST SSDF PW.7 – Review and\u002For Analyze Human-Readable Code to Identify Vulnerabilities","OWASP ASVS V2 – Authentication Verification Requirements","GDPR Article 32 – Security of Processing (where personal data is handled by BTP applications)","ITIL Change Management – Regression Testing Controls for Patches","SAP Security Baseline – Patch and Vulnerability Management",{}]