SAP Cloud SDK EUVD-2026-98193

Exploitation requires a multi-tenant SAP BTP application built on the SAP Cloud SDK for Python where the attacker can control or influence the tenant_subdomain parameter used to construct the OAuth2 token endpoint; this attacker-controlled subdomain is redirected to an attacker server to capture client credentials. Limiting factors: the target must be a multi-tenant deployment using the affected SDK for OAuth2 token acquisition, and the attacker must have a path to supply or manipulate the tenant_subdomain input - single-tenant deployments or configurations that do not derive the token URL from attacker-influenced subdomain data are not exposed. No user interaction and no application authentication are indicated by the CVSS vector (UI:N/PR:N).

This is a maximum-severity (CVSS 10.0) server-side request forgery (CWE-918) in the SAP Cloud SDK for Python affecting multi-tenant SAP BTP applications. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) describes a network-reachable, low-complexity attack with no required privileges and a scope change, which aligns with an attacker influencing the tenant_subdomain parameter to redirect OAuth2 token requests and exfiltrate client credentials to an attacker-controlled server. Weighing the signals: the CVSS score is at the ceiling and the weakness class (OAuth2 credential theft via SSRF) is genuinely serious because stolen client credentials can enable broad follow-on compromise, which justifies high-priority remediation for anyone running affected multi-tenant BTP apps. However, several real-risk signals are MISSING: no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or widespread exploitation at time of analysis. There is also a notable qualifier the raw score hides: exploitation depends on the attacker being able to control the tenant_subdomain input in a multi-tenant deployment, so the PR:N rating reflects protocol-level unauthenticated reachability rather than a trivially internet-exposed default. One data tension to verify: the CVSS assigns I:H (high integrity impact), but the described outcome is credential exfiltration, which is primarily a confidentiality impact - the integrity rating likely reflects downstream credential misuse rather than direct data tampering, and should be confirmed with SAP's advisory.

An attacker interacting with a multi-tenant SAP BTP application built on the SAP Cloud SDK for Python supplies a malicious value for the tenant_subdomain parameter, causing the SDK to direct its OAuth2 token request to an attacker-controlled host instead of the legitimate identity provider. The application's client credentials are transmitted to that host and captured, giving the attacker reusable OAuth2 credentials. No public exploit was identified at time of analysis, and exploitation requires that the attacker can influence the tenant_subdomain value processed by the SDK.