At its monthly security update in October, SAP reported a vulnerability with the highest severity rating. It affects a Python library used to connect custom applications to SAP cloud services. Through the flaw, technical credentials can reach third parties, who could then access connected systems.
The case does not concern the standard software that SAP itself operates, but extensions built by customers or partners. These remain the responsibility of the company.
We therefore recommend keeping a register of all extensions with the libraries and versions they use, tightly limited rights for technical users and a clear agreement with the partner on who tracks security notes. Where the affected library is in use, the version and the credentials should be renewed without delay.