CVE-2026-120012
Received Received - Intake

Sensitive Credentials Exposure in SAP Cloud SDK for AI

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: SAP SE

Description
SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forwarded error output could obtain these credentials, but only after waiting for a suitable failure event triggered by a higher-privileged user and within the limited lifetime of the token, making exploitation complex. Successful exploitation could allow the attacker to reuse the disclosed credentials against the associated SAP service, resulting in a high impact on confidentiality, integrity and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-120012
EUVD
EUVD-2026-120851

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
sap cloud_sdk_for_ai *
sap cloud_sdk_for_ai to 2.17.0 (inc)
sap cloud_sdk_for_ai 2.18.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SAP Cloud SDK for AI (Node.js) may include sensitive authentication credentials in error messages during specific failure conditions. An attacker with low privileges could access these credentials if they occur after a higher-privileged user triggers a failure and within the token's limited lifetime. Exploitation is complex but could allow credential reuse against SAP services, impacting confidentiality, integrity, and availability.

Detection Guidance

Check application logs and error messages for exposed authentication credentials. Monitor for error events triggered by higher-privileged users. Ensure SAP Cloud SDK for AI is updated to version 2.18.0 or later to prevent this issue.

Impact Analysis

If exploited, this vulnerability could allow an attacker to obtain sensitive credentials from error logs, potentially reusing them to access SAP services. This may lead to unauthorized data access, service disruption, or data manipulation, affecting confidentiality, integrity, and availability of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance may result in legal penalties, reputational damage, and loss of trust due to exposed credentials and potential data breaches.

Mitigation Strategies

Upgrade SAP Cloud SDK for AI (Node.js) to version 2.18.0 or later immediately. Review and sanitize application logs to remove any sensitive credentials. Restrict access to error logs and outputs to minimize exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120012. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...