I found OAuth credential exposure flaws in the official MCP Python and TypeScript SDKs. Why patching CVE-2026-115563 and CVE-2026-104850 may not be enough.
Six SAP Cloud SDK for Python releases skip tenant checks in Destination calls, enabling OAuth2 client secret leaks if attackers control tenant names.
SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python.
SAP has patched a maximum-severity flaw in its Cloud SDK for Python that could expose OAuth credentials in multi-tenant BTP applications, alongside 19 other vulnerabilities in its October security ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results