SAP patched a critical SSRF vulnerability (CVE-2026-89111, CVSS 10.0) in its Cloud SDK for Python. Unauthenticated attackers can steal OAuth2 client credentials from https://deafnews.it/en/article/cve-2026-89111-critical-ssrf-in-sap-cloud-sdk-for-python-exfiltrates-credentials