Sensitive Authentication Credential Leak in SAP Cloud SDK for AI by SAP

CVE-2026-120012

What is CVE-2026-120012?

The SAP Cloud SDK for AI (Node.js) may inadvertently expose sensitive authentication credentials in error messages generated during specific internal operations under certain failure conditions. This vulnerability arises when an attacker, possessing limited privileges, gains access to application logs or error outputs. The attacker can potentially retrieve sensitive credentials after waiting for a failure event induced by a higher-privileged user, and this process is constrained by the limited lifetime of the tokens involved. The complexities surrounding the exploitation make it less straightforward, but successful attacks could allow unauthorized reuse of these credentials against SAP services, jeopardizing the confidentiality, integrity, and availability of the affected systems.

References