WhatBrokeToday
FAQ
Today's Trends
highInvestigatingNode.js

SAP Cloud SDK for AI (Node.js) CVE-2026-120012 Leaks Credentials in Errors

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

SAP Cloud SDK for AI (Node.js) is affected by a high-severity vulnerability (CVE-2026-120012) where sensitive authentication credentials can be inadvertently included in error messages generated during specific internal failure conditions. Applications utilizing this SDK are affected, potentially exposing tokens to users with access to logs or error outputs.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

The SDK inadvertently includes sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions.

Evidence

1 report · 1 CVEShow
  1. [1]
    CVE First report
    SAP Cloud SDK for AI (Node.js): CVE-2026-120012 (High)(opens security advisory in a new tab)

    High severity. SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forwarded error output could obtain these credentials, but only after waiting for a suitable failure event triggered by a higher-privileged user and within the limited lifetime of the token, making exploitation complex.…

    by Tenable 0upvotes 0comments

Timeline

  1. First report on security advisory

    SAP Cloud SDK for AI (Node.js): CVE-2026-120012 (High)

    Source