SAP November patch day fixes four CVSS 10.0 flaws
Unauthenticated memory corruption in ICM and Web Dispatcher may allow code execution; exploitation is not discussed.
70
CVE-2026-120013
Path traversal in SAP agent_memory before 0.50.0
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
The agent_memory module builds secret-resolution filesystem paths from a caller-supplied tenant argument to create_client. Before 0.50.0 that value is not validated, so path traversal can escape the intended directory and read another tenant's mounted credentials, including OAuth client IDs and secrets, under /etc/secrets/appfnd/hana-agent-memory/. A remote caller can trigger this without authentication or user interaction. Deployments before 0.50.0 are affected.
What to do: Upgrade the agent_memory module to version 0.50.0.
| Product | Affected | Fixed in |
|---|---|---|
| SAP agent_memory | prior to 0.50.0 | 0.50.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value containing path traversal sequences (for example, attacker-corp/../victim-corp) could cause the resolved path to escape the intended directory and access another tenant's secrets under:Plain Text/etc/secrets/appfnd/hana-agent-memory/ /Successful exploitation could allow unauthorized access to another tenant's mounted credentials, including OAuth client IDs and client secrets. This vulnerability could enable cross-tenant access to sensitive credentials.
- Weakness
- CWE-22
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N