CVE-2026-120012: Information Disclosure vulnerability in SAP Cloud SDK for AI(JavaScript)
SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forwarded error output could obtain these credentials, but only after waiting for a suitable failure event triggered by a higher-privileged user and within the limited lifetime of the token, making exploitation complex. Successful exploitation could allow the attacker to reuse the disclosed credentials against the associated SAP service, resulting in a high impact on confidentiality, integrity and availability.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications using SAP Cloud SDK for AI (Node.js) are exposed if their error messages can be read through application logs or forwarded error output by a low-privileged user. Exposure depends on a qualifying internal failure occurring during a higher-privileged user's operation.
What does an attacker need to exploit it?
An attacker needs low-privileged access to application logs or forwarded error output, and must obtain an error generated under the specified failure conditions. They must also act while the disclosed token remains valid.
How can the disclosed credentials be used?
The credentials may be reused against the associated SAP service. Successful reuse can affect confidentiality, integrity, and availability.