SAP November patch day fixes four CVSS 10.0 flaws
Unauthenticated memory corruption in ICM and Web Dispatcher may allow code execution; exploitation is not discussed.
70
CVE-2026-120012
Credential leak in SAP Cloud SDK for AI error messages
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
SAP Cloud SDK for AI (Node.js) can include authentication credentials in error messages from certain internal operations under specific failure conditions. A low-privileged attacker who can read application logs or forwarded error output may obtain those credentials only after a higher-privileged user triggers a suitable failure and only while the token is still valid. Reusing them against the associated SAP service can affect confidentiality, integrity, and availability. Affected and fixed versions are not stated.
What to do: Apply SAP's update for CVE-2026-120012. No workaround is named.
| Product | Affected |
|---|---|
| SAP Cloud SDK for AI (Node.js) | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forwarded error output could obtain these credentials, but only after waiting for a suitable failure event triggered by a higher-privileged user and within the limited lifetime of the token, making exploitation complex. Successful exploitation could allow the attacker to reuse the disclosed credentials against the associated SAP service, resulting in a high impact on confidentiality, integrity and availability.
- Weakness
- CWE-209
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H