CVE-2026-120012: SAP Cloud SDK for AI (Node.js) can leak auth credentials into error messages, fixed in @sap-ai-sdk/ai-api 2.18.0
SAP's Node.js SDK for AI (@sap-ai-sdk/ai-api 2.17.0 and earlier) could include authentication credentials in error messages under certain failure conditions, so anyone who can read your logs or forwarded error output could reuse the token against the SAP service. Upgrade to 2.18.0, which stops logging the destination.
What it is
Under specific failure conditions, internal operations in the SDK put sensitive authentication credentials into the error messages they generate (CWE-209).
An attacker with low privileges and access to application logs or forwarded error output could pick up the credentials and reuse them while the token is still valid. SAP rates exploitation as complex but the impact as high.
SAP's patch note: the destination was removed from the logged values. No workaround is available.
How to check
- Run npm ls @sap-ai-sdk/ai-api and see whether you're on 2.17.0 or earlier.
- Check where your app's error output goes (log aggregators, error trackers, chat alerts) and who can read it.
How to fix
- Upgrade @sap-ai-sdk/ai-api to 2.18.0 or later.
- If error logs from affected versions were shared widely, rotate the SAP AI Core service credentials they may contain.
npm ls @sap-ai-sdk/ai-api
npm install @sap-ai-sdk/ai-api@^2.18.0