SAP’s October security updates include a reported critical issue in the SAP Cloud SDK for Python that could expose OAuth 2.0 client credentials to an attacker-controlled server under affected conditions. This is important for multi-tenant applications because client secrets can unlock API access beyond a single user session.
Inventory services using the SDK, compare deployed versions against SAP’s current security guidance, and schedule remediation based on internet exposure, tenant isolation, and credential privileges. Scope credentials narrowly and rotate them when logs or configuration suggest they may have been sent to an unintended endpoint.
Review outbound requests from workloads using the SDK for unexpected authorization destinations and unusual OAuth token activity. SAP security notes provide authoritative affected-version and remediation details.