{"metadata": {"vulnerability": "CVE-2026-89111", "count": 18, "kinds": {"milestone": 4, "sighting": 9, "kev": 0, "other": 5}}, "data": [{"timestamp": "2026-09-10T22:24:03.823Z", "date_only": false, "value": "2026-09-10T22:24:03.823Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-89111", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-13T00:24:28.269Z", "date_only": false, "value": "2026-10-13T00:24:28.269Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-89111", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-13T01:05:42.364Z", "date_only": false, "value": "2026-10-13T01:05:42.364936Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117430913722990375", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "dac115f5-088a-4f61-abc2-276ba380ea86", "content": "CVE-2026-89111 OAuth2 SSRF vulnerability in SAP Cloud SDK for Python The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.\nhttps://www.cve.org/CVERecord?id=CVE-2026-89111https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-4mv3-jxxm-9cx2https://url.sap/sapsecuritypatchday#SAP_SE #SAPCloud#CVE_2026_89111#bot", "url": "https://infosec.exchange/users/cve/statuses/117430913722990375"}, {"timestamp": "2026-10-13T01:16:47Z", "date_only": false, "value": "2026-10-13T01:16:47Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-M3J7-WP2J-MHC3", "record": "GHSA-M3J7-WP2J-MHC3", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-13T01:16:47.890Z", "date_only": false, "value": "2026-10-13T01:16:47.890", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89111", "record": "FKIE_CVE-2026-89111", "field": "published"}, {"timestamp": "2026-10-13T02:08:56.031Z", "date_only": false, "value": "2026-10-13T02:08:56.031388Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxpx7z4ywh2l", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "bb3b8990-8d94-4ba2-ab83-7d67fa76d50c", "content": "\ud83d\udea8 CVE-2026-89111 \u2014 CVSS 10 CRITICAL\n\nThe SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications....\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89111\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxpx7z4ywh2l"}, {"timestamp": "2026-10-13T02:20:04.616Z", "date_only": false, "value": "2026-10-13T02:20:04.616675Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxpxtwg2md2x", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "5e753095-5230-42cf-9a33-4b068e7727b8", "content": "CVE-2026-89111\nThe SAP Cloud SDK for Python used in multi-tenant Business Technology Platform apps can be tricked into sending its authentication tokens to a server you control. If an attacker changes the tenant_subdomain\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxpxtwg2md2x"}, {"timestamp": "2026-10-13T02:26:32.201Z", "date_only": false, "value": "2026-10-13T02:26:32.201Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-89111", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T02:26:32.201Z", "date_only": false, "value": "2026-10-13T02:26:32.201Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / sap", "record": "CVE-2026-89111", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T03:00:27.419Z", "date_only": false, "value": "2026-10-13T03:00:27.419069Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117431364922657116", "record": "cve-2026-89111", "field": "creation_timestamp", "uuid": "5e004373-3007-472e-baa1-a316344b58f7", "content": "CRITICAL SSRF (CVE-2026-89111) in SAP Cloud SDK for Python: attackers can redirect OAuth2 token requests via tenant_subdomain, exposing client credentials. No patch yet. Restrict input, monitor traffic. https://radar.offseq.com/threat/cve-2026-89111-cwe-918-server-side-request-forgery-in-sapse-sap-cloud-b5baed1f14ad0244 #OffSeq #SAP #SSRF #Vulnerability", "url": "https://infosec.exchange/users/offseq/statuses/117431364922657116"}, {"timestamp": "2026-10-13T03:00:29.680Z", "date_only": false, "value": "2026-10-13T03:00:29.680380Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxq246uvp72l", "record": "cve-2026-89111", "field": "creation_timestamp", "uuid": "282fe367-abf6-49ad-8b79-042ca48193d2", "content": "SAP Cloud SDK for Python hit by CRITICAL SSRF (CVE-2026-89111) - attackers can hijack OAuth2 token requests & steal credentials. No patch yet; restrict tenant_subdomain now. https://radar.offseq.com/threat/cve-2026-89111-cwe-918-server-side-request-forgery-in-sapse-sap-cloud-b5baed1f14ad0244 #Off...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mxq246uvp72l"}, {"timestamp": "2026-10-13T03:16:41.133Z", "date_only": false, "value": "2026-10-13T03:16:41.133", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89111", "record": "FKIE_CVE-2026-89111", "field": "lastModified"}, {"timestamp": "2026-10-13T03:30:30Z", "date_only": false, "value": "2026-10-13T03:30:30Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-M3J7-WP2J-MHC3", "record": "GHSA-M3J7-WP2J-MHC3", "field": "published"}, {"timestamp": "2026-10-13T03:30:30Z", "date_only": false, "value": "2026-10-13T03:30:30Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-M3J7-WP2J-MHC3", "record": "GHSA-M3J7-WP2J-MHC3", "field": "modified"}, {"timestamp": "2026-10-13T17:14:08.170Z", "date_only": false, "value": "2026-10-13T17:14:08.170501Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mxrjsneaux2u", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "c8d461fa-43ba-4a50-bce9-c3e154457171", "content": "SAP Cloud SDK for Python CVE-2026-89111, max-severity OAuth2 SSRF, lets attackers steal client credentials via a crafted tenant_subdomain. Patch to October 2026's release or allowlist tenant subdomains. https://cti.securitycyber.uk", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mxrjsneaux2u"}, {"timestamp": "2026-10-13T22:49:06.746Z", "date_only": false, "value": "2026-10-13T22:49:06.746646Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117436038932932309", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "6c8eeada-63f6-493a-b66a-570236d45f8f", "content": "SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft\nSAP has disclosed a critical flaw (CVE-2026-89111, CVSS 10.0) in its Cloud SDK for Python that can send an application\u2019s OAuth2 client credentials to a server an attacker controls, The Hacker News reports. The flaw affects multi-tenant applications on SAP Business Technology Platform where an attacker can control the tenant subdomain; a fix first shipped in version 0.45.2. https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html", "url": "https://infosec.exchange/users/edwardk/statuses/117436038932932309"}, {"timestamp": "2026-10-13T22:49:08.335Z", "date_only": false, "value": "2026-10-13T22:49:08.335247Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mxs4jnqiu32h", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "29da6e6b-e278-4a9e-becd-8c09313a5a3a", "content": "SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft\n\nSAP has disclosed a critical flaw (CVE-2026-89111, CVSS 10.0) in its Cloud SDK for Python that can send an application\u2019s OAuth2 cli... https://threatintel.cc/2026/10/13/sap-discloses-critical-cvss-flaw.html", "url": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mxs4jnqiu32h"}, {"timestamp": "2026-10-14T00:30:06.162Z", "date_only": false, "value": "2026-10-14T00:30:06.162987Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxsc67nchd2f", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "b8887118-f5f0-4d66-93a7-2a65e446fa98", "content": "\ud83e\udd16 CVE-2026-89111 (CVSS 10.0): OAuth2 SSRF in SAP Cloud SDK for Python. In multi-tenant BTP apps, an attacker controlling tenant_subdomain can redirect token requests to steal the app's client credentials.\nhttps://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-4mv3-jxxm-9cx2", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mxsc67nchd2f"}]}