CVE-2026-120012

SAP AI SDK error output could disclose authentication credentials

SAP · Cloud SDK for AI for JavaScript

First documented disclosure · Review checkpoint

Summary

A low-privilege reader of logs or forwarded errors could obtain a credential from a failed privileged operation.

Severity and exploitation evidence

High · 7.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources describe the vulnerability and its conditions. They do not identify malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Some internal failure paths included authentication material in error messages.

Conditions required

A higher-privilege operation fails, another user can access its error output and the credential is still valid.

Potential impact

The credential could permit actions allowed to its original holder before it expires.

Affected versions and configurations

Through 2.17.0.

Fix and mitigation status

2.18.0.

Practical next steps

Upgrade to 2.18.0. Limit access to forwarded errors and assess whether credentials captured in older logs require revocation.

Operating lesson

Remove credentials from exception messages before logs or monitoring services receive them.

Evidence and limits

SAP describes a limited token lifetime and a specific failure condition. No real-world credential use is documented.

Sources