Source: thehackernews.com
SAP disclosed a critical CVSS 10.0 vulnerability in its Cloud SDK for Python, affecting multi-tenant applications on SAP Business Technology Platform (BTP). The flaw can cause an application's OAuth2 client credentials to be sent to an attacker-controlled server. The vulnerability specifically impacts applications using the SDK as SAP's official Python client for BTP services. Exploitation requires the attacker to control a tenant subdomain. SAP published a security advisory on October 13, 2026, disclosing the issue. The severity of CVSS 10 indicates maximum criticality, suggesting the flaw is easily exploitable with high impact. Organizations using SAP BTP with the Python Cloud SDK in multi-tenant configurations are at risk of credential compromise and potential unauthorized access to BTP services.
