SAP has disclosed a critical security flaw in its Cloud SDK for Python affecting certain multi-tenant applications running on SAP Business Technology Platform (BTP). According to SAP's advisory, the issue could cause an application's OAuth2 client credentials to be sent to a server controlled by an attacker under specific conditions.

For businesses using SAP BTP with Python-based services or integrations, the main risk is credential exposure. If exploited, stolen OAuth2 client credentials could potentially be used to access connected services or application resources, depending on how the affected application is configured.

What happened

SAP said the vulnerability affects its official Cloud SDK for Python used to connect applications with BTP services. The company described the issue as critical and assigned it a CVSS score of 10.0.

Based on the advisory details referenced in the source, the flaw affects multi-tenant applications, and exploitation requires an attacker to be able to control the tenant subdomain. In that scenario, the application may send OAuth2 client credentials to infrastructure the attacker controls.

The source does not provide broader evidence of active exploitation, and businesses should rely on SAP's advisory and follow-up technical guidance for confirmed remediation details, affected versions and update instructions.

Why it matters for European businesses

This is relevant for European companies that rely on SAP for business-critical systems, integrations and custom applications. SAP BTP is commonly used to extend ERP, commerce, analytics and workflow environments, so a weakness in an official SDK can affect not just developers but also operational and compliance teams.

Credential theft risks are especially serious in cloud environments because OAuth2 client credentials are often used for system-to-system authentication. If those credentials are exposed, attackers may be able to impersonate trusted application components, access APIs or move further into connected business systems.

For regulated organisations, the issue may also raise wider governance questions around secure software supply chains, third-party components, tenant isolation and secrets management. Even when the attack conditions are narrow, a critical flaw in a core SDK deserves urgent review because it may affect production services that handle business data or customer transactions.

Who may be affected

• Businesses running multi-tenant applications on SAP BTP that use the SAP Cloud SDK for Python.
• IT and development teams maintaining Python-based SAP integrations, extensions or internal tools.
• E-commerce and digital operations teams if SAP-connected applications support ordering, customer workflows or back-office processes.
• Regulated businesses that depend on SAP environments for sensitive operational or business data.

Companies using SAP products but not this specific Python SDK or not operating multi-tenant BTP applications may not be affected in the same way. Exposure depends on architecture, deployment model and whether the vulnerable component is in use.

What companies should consider

• Check SAP's official advisory immediately to confirm whether your versions, applications and deployment model are affected.
• Inventory Python-based SAP BTP applications, especially multi-tenant services and custom extensions built with the Cloud SDK for Python.
• Prioritise vendor-recommended patches or upgrades as soon as they are available for your environment.
• Review OAuth2 client credentials and secrets used by affected applications, and consider rotation where exposure cannot be ruled out.
• Audit logs and outbound connections for unusual authentication behaviour, unexpected token requests or suspicious tenant-related activity.
• Review tenant validation and isolation controls in application design, particularly where routing or trust decisions depend on tenant subdomains.
• Limit credential scope where possible so that a compromised client secret would have reduced downstream impact.

For European SMEs and larger organisations alike, the immediate priority is to verify whether affected SAP BTP Python applications are in use and to treat this as a high-priority remediation task if they are.