{"metadata": {"vulnerability": "cve-2026-89111", "count": 30, "kinds": {"milestone": 5, "sighting": 15, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-10T22:24:03.823Z", "date_only": false, "value": "2026-09-10T22:24:03.823Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-89111", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1300", "record": "CERTFR-2026-AVI-1300", "field": "last_revision_date"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1300", "record": "CERTFR-2026-AVI-1300", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1300", "record": "CERTFR-2026-AVI-1300", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-13T00:24:28.269Z", "date_only": false, "value": "2026-10-13T00:24:28.269Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-89111", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-13T01:05:42.364Z", "date_only": false, "value": "2026-10-13T01:05:42.364936Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117430913722990375", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "dac115f5-088a-4f61-abc2-276ba380ea86", "content": "CVE-2026-89111 OAuth2 SSRF vulnerability in SAP Cloud SDK for Python The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.\nhttps://www.cve.org/CVERecord?id=CVE-2026-89111https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-4mv3-jxxm-9cx2https://url.sap/sapsecuritypatchday#SAP_SE #SAPCloud#CVE_2026_89111#bot", "url": "https://infosec.exchange/users/cve/statuses/117430913722990375"}, {"timestamp": "2026-10-13T01:16:47Z", "date_only": false, "value": "2026-10-13T01:16:47Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-M3J7-WP2J-MHC3", "record": "GHSA-M3J7-WP2J-MHC3", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-13T01:16:47.890Z", "date_only": false, "value": "2026-10-13T01:16:47.890", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89111", "record": "FKIE_CVE-2026-89111", "field": "published"}, {"timestamp": "2026-10-13T02:08:56.031Z", "date_only": false, "value": "2026-10-13T02:08:56.031388Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxpx7z4ywh2l", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "bb3b8990-8d94-4ba2-ab83-7d67fa76d50c", "content": "\ud83d\udea8 CVE-2026-89111 \u2014 CVSS 10 CRITICAL\n\nThe SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications....\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89111\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxpx7z4ywh2l"}, {"timestamp": "2026-10-13T02:20:04.616Z", "date_only": false, "value": "2026-10-13T02:20:04.616675Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxpxtwg2md2x", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "5e753095-5230-42cf-9a33-4b068e7727b8", "content": "CVE-2026-89111\nThe SAP Cloud SDK for Python used in multi-tenant Business Technology Platform apps can be tricked into sending its authentication tokens to a server you control. If an attacker changes the tenant_subdomain\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxpxtwg2md2x"}, {"timestamp": "2026-10-13T02:26:32.201Z", "date_only": false, "value": "2026-10-13T02:26:32.201Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / sap", "record": "cve-2026-89111", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T03:00:27.419Z", "date_only": false, "value": "2026-10-13T03:00:27.419069Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117431364922657116", "record": "cve-2026-89111", "field": "creation_timestamp", "uuid": "5e004373-3007-472e-baa1-a316344b58f7", "content": "CRITICAL SSRF (CVE-2026-89111) in SAP Cloud SDK for Python: attackers can redirect OAuth2 token requests via tenant_subdomain, exposing client credentials. No patch yet. Restrict input, monitor traffic. https://radar.offseq.com/threat/cve-2026-89111-cwe-918-server-side-request-forgery-in-sapse-sap-cloud-b5baed1f14ad0244 #OffSeq #SAP #SSRF #Vulnerability", "url": "https://infosec.exchange/users/offseq/statuses/117431364922657116"}, {"timestamp": "2026-10-13T03:00:29.680Z", "date_only": false, "value": "2026-10-13T03:00:29.680380Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxq246uvp72l", "record": "cve-2026-89111", "field": "creation_timestamp", "uuid": "282fe367-abf6-49ad-8b79-042ca48193d2", "content": "SAP Cloud SDK for Python hit by CRITICAL SSRF (CVE-2026-89111) - attackers can hijack OAuth2 token requests & steal credentials. No patch yet; restrict tenant_subdomain now. https://radar.offseq.com/threat/cve-2026-89111-cwe-918-server-side-request-forgery-in-sapse-sap-cloud-b5baed1f14ad0244 #Off...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mxq246uvp72l"}, {"timestamp": "2026-10-13T03:30:30Z", "date_only": false, "value": "2026-10-13T03:30:30Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-M3J7-WP2J-MHC3", "record": "GHSA-M3J7-WP2J-MHC3", "field": "published"}, {"timestamp": "2026-10-13T03:30:30Z", "date_only": false, "value": "2026-10-13T03:30:30Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-M3J7-WP2J-MHC3", "record": "GHSA-M3J7-WP2J-MHC3", "field": "modified"}, {"timestamp": "2026-10-13T17:14:08.170Z", "date_only": false, "value": "2026-10-13T17:14:08.170501Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mxrjsneaux2u", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "c8d461fa-43ba-4a50-bce9-c3e154457171", "content": "SAP Cloud SDK for Python CVE-2026-89111, max-severity OAuth2 SSRF, lets attackers steal client credentials via a crafted tenant_subdomain. Patch to October 2026's release or allowlist tenant subdomains. https://cti.securitycyber.uk", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mxrjsneaux2u"}, {"timestamp": "2026-10-13T22:49:06.746Z", "date_only": false, "value": "2026-10-13T22:49:06.746646Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117436038932932309", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "6c8eeada-63f6-493a-b66a-570236d45f8f", "content": "SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft\nSAP has disclosed a critical flaw (CVE-2026-89111, CVSS 10.0) in its Cloud SDK for Python that can send an application\u2019s OAuth2 client credentials to a server an attacker controls, The Hacker News reports. The flaw affects multi-tenant applications on SAP Business Technology Platform where an attacker can control the tenant subdomain; a fix first shipped in version 0.45.2. https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html", "url": "https://infosec.exchange/users/edwardk/statuses/117436038932932309"}, {"timestamp": "2026-10-13T22:49:08.335Z", "date_only": false, "value": "2026-10-13T22:49:08.335247Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mxs4jnqiu32h", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "29da6e6b-e278-4a9e-becd-8c09313a5a3a", "content": "SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft\n\nSAP has disclosed a critical flaw (CVE-2026-89111, CVSS 10.0) in its Cloud SDK for Python that can send an application\u2019s OAuth2 cli... https://threatintel.cc/2026/10/13/sap-discloses-critical-cvss-flaw.html", "url": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mxs4jnqiu32h"}, {"timestamp": "2026-10-14T00:30:06.162Z", "date_only": false, "value": "2026-10-14T00:30:06.162987Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxsc67nchd2f", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "b8887118-f5f0-4d66-93a7-2a65e446fa98", "content": "\ud83e\udd16 CVE-2026-89111 (CVSS 10.0): OAuth2 SSRF in SAP Cloud SDK for Python. In multi-tenant BTP apps, an attacker controlling tenant_subdomain can redirect token requests to steal the app's client credentials.\nhttps://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-4mv3-jxxm-9cx2", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mxsc67nchd2f"}, {"timestamp": "2026-10-14T01:14:58.762Z", "date_only": false, "value": "2026-10-14T01:14:58.762175Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/fishwalkerit.bsky.social/post/3mxseogsfji2f", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "4cd04d82-8873-494b-aac6-ffa6448a0baa", "content": "L\u1ed7 h\u1ed5ng CVSS 10.0 trong SAP Cloud SDK for Python: k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 \u0111\u00e1nh c\u1eafp credentials\u00a0OAuth2\n\nNg\u00e0y 13/10/2026, SAP c\u00f4ng b\u1ed1 CVE-2026-89111 \u2014 l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng \u1edf m\u1ee9c t\u1ed1i \u0111a (\u0111i\u1ec3m CVSS 10.0/10) trong SAP Cloud SDK for Python, b\u1ed9 SDK ch\u00ednh th\u1ee9c \u0111\u1ec3 x\u00e2y d\u1ef1ng \u1ee9ng d\u1ee5ng Python v\u00e0 AI agent tr\u00ean n\u1ec1n\u2026", "url": "https://bsky.app/profile/fishwalkerit.bsky.social/post/3mxseogsfji2f"}, {"timestamp": "2026-10-14T01:16:05.032Z", "date_only": false, "value": "2026-10-14T01:16:05.032753Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacks.gr/post/3mxseqfxndoph", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "c8ae9cad-b62e-4b7e-adf7-989e2e686acb", "content": "A flaw in SAP's Cloud SDK for Python (CVE-2026-89111) could route OAuth2 credentials to external servers when tenant subdomains are controlled.\n\nPatches are available.\n\nhttps://en.hacks.gr/krisimo-keno-asfaleias-se-ergaleio-tis-sap-gia-efarmoges-python/\n\n#SAP #Python #Cloud", "url": "https://bsky.app/profile/hacks.gr/post/3mxseqfxndoph"}, {"timestamp": "2026-10-14T01:58:49.999Z", "date_only": false, "value": "2026-10-14T01:58:49.999346Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mxsh4urmwe2n", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "c54a3270-9165-4eef-bbf4-1b6b8754edb0", "content": "CVE-2026-89111 is trending. Hype score 4, currently #7 on cvemon.\n\nThe SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-89111", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mxsh4urmwe2n"}, {"timestamp": "2026-10-14T06:27:21.915Z", "date_only": false, "value": "2026-10-14T06:27:21.915742Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxsw4zs2z322", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "1af6860f-9f45-4649-8822-cdb0df452d39", "content": "SAP\u3001NetWeaver\u3068S/4HANA\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u3092\u4fee\u6b63\n\n\u4f01\u696d\u5411\u3051\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u5927\u624b\u306eSAP\u306f\u706b\u66dc\u65e5\u3001\u65b0\u898f\u304a\u3088\u3073\u66f4\u65b0\u3055\u308c\u305f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ce\u30fc\u30c822\u4ef6\u3092\u516c\u958b\u3057\u305f\u3068\u767a\u8868\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u3046\u30614\u4ef6\u306f\u3001\u91cd\u5927\u5ea6\u300c\u30af\u30ea\u30c6\u30a3\u30ab\u30eb\u300d\u306e\u8106\u5f31\u6027\u306b\u5bfe\u51e6\u3059\u308b\u3082\u306e\u3067\u3059\u3002 \u6700\u3082\u6df1\u523b\u306a\u306e\u306f\u3001CVE-2026-89111\uff08CVSS\u30b9\u30b3\u30a210/10\uff09\u3067\u3059\u3002Cloud SDK for Python\u306b\u5b58\u5728\u3059\u308bOAuth", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxsw4zs2z322"}, {"timestamp": "2026-10-14T08:10:18.761Z", "date_only": false, "value": "2026-10-14T08:10:18.761835Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mxt3v4sq3k2x", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "7a12d2b5-1b09-47b9-bf3b-d385d15d87e2", "content": "CVE-2026-89111: Critical SSRF in SAP Cloud SDK for Python Exfiltrates Credentials", "url": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mxt3v4sq3k2x"}, {"timestamp": "2026-10-14T19:14:40.871Z", "date_only": false, "value": "2026-10-14T19:14:40.871271Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-89111", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T19:14:40.871Z", "date_only": false, "value": "2026-10-14T19:14:40.871271Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89111", "record": "FKIE_CVE-2026-89111", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T19:14:49.793Z", "date_only": false, "value": "2026-10-14T19:14:49.793Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-89111", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:14:49.793Z", "date_only": false, "value": "2026-10-14T19:14:49.793Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-89111", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T07:00:31.451Z", "date_only": false, "value": "2026-10-15T07:00:31.451255Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxvihaonhe2f", "record": "CVE-2026-89111", "field": "creation_timestamp", "uuid": "30843d54-8a1b-409a-81af-fa9c2b611e95", "content": "CVE-2026-89111 lets attacker-controlled tenant subdomains redirect SAP Cloud SDK OAuth2 requests, potentially exposing client credentials. SAP patched the flaw; independently reported validation gaps affect versions 0.53.0\u20130.55.0. No confirmed exploitation was reported.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxvihaonhe2f"}, {"timestamp": "2026-10-15T20:38:04.303Z", "date_only": false, "value": "2026-10-15T20:38:04.303", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89111", "record": "FKIE_CVE-2026-89111", "field": "lastModified"}]}