CVE-2026-120012

SAP Cloud SDK for AI Node.js could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forwarded error output could obtain these...

CVE-2026-120013

The SAP Cloud SDK for Python contains a path traversal vulnerability in its agent_memory module. Prior to version 0.50.0 , the create_client(tenant=...) function fails to validate the tenant parameter before using it to construct filesystem paths for secret resolution. An attacker could provide a...

CVE-2026-120013 Path Traversal in Agent Memory Module of SAP Cloud SDK for Python

The agentmemory module accepts a caller-supplied tenant parameter in createclienttenant=.... Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value containing path traversal sequences for example,...

CVE-2026-120012

The SAP Cloud SDK for AI (Node.js) contains an information disclosure vulnerability where certain internal operations may include sensitive authentication credentials in error messages under specific failure conditions. An attacker with low privileges who can access application logs or forwarded ...

CVE-2026-109799

The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability CWE-347 in IASContextProvider, the runtime-context provider registered by default via bootstrapapp.IASContextProvider extracted the apptid, sapgtid and useruuid claims from the IAS JWT in the...

CVE-2026-109799 Improper verification of JWT signature in IASContextProvider leads to tenant/user identity spoofing ( sap-cloud-sdk (pip))

The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability CWE-347 in IASContextProvider, the runtime-context provider registered by default via bootstrapapp.IASContextProvider extracted the apptid, sapgtid and useruuid claims from the IAS JWT in the...

EUVD-2026-120706

The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability CWE-347 in IASContextProvider, the runtime-context provider registered by default via bootstrapapp.IASContextProvider extracted the apptid, sapgtid and useruuid claims from the IAS JWT in the...

CVE-2026-109799

The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability CWE-347 in IASContextProvider, the runtime-context provider registered by default via bootstrapapp.IASContextProvider extracted the apptid, sapgtid and useruuid claims from the IAS JWT in the...

CVE-2026-109799

The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in the IASContextProvider . The component, registered via bootstrap(app).IASContextProvider, extracts app_tid, sap_gtid, and user_uuid claims from the IAS JWT in the Authorization header...

PT-2026-141290

The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability CWE-347 in IASContextProvider, the runtime-context provider registered by default via bootstrapapp.IASContextProvider extracted the app tid, sap gtid and user uuid claims from the IAS JWT in the...

CVE-2026-109799: SAP_SE SAP Cloud SDK for Python: The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in…

The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability CWE-347 in IASContextProvider, the runtime-context provider registered by default via bootstrapapp.IASContextProvider extracted the apptid, sapgtid and useruuid claims from the IAS JWT in the...

CVE-2026-89111

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenantsubdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. This vulnerability...

CVE-2026-89111

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability (CWE-918) affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to a server they control. This allows for the exfiltration of client credentials . The v...

CVE-2026-89111

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenantsubdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated...

CVE-2026-89111 OAuth2 SSRF vulnerability in SAP Cloud SDK for Python

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenantsubdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. This vulnerability...

CVE-2026-89111 OAuth2 SSRF vulnerability in SAP Cloud SDK for Python

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenantsubdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. This vulnerability...

EUVD-2026-98193

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenantsubdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated...

CVE-2026-89111 OAuth2 SSRF vulnerability in SAP Cloud SDK for Python

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenantsubdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. This vulnerability...

PT-2026-111138

Name of the Vulnerable Software and Affected Versions sap-cloud-sdk versions prior to 0.45.2 Description The SAP Cloud SDK for Python contains a Server-Side Request Forgery SSRF issue affecting multi-tenant SAP Business Technology Platform BTP applications. An attacker who controls the tenant...

CVE-2026-89111: Server-Side Request Forgery (SSRF)

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenantsubdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated...