What happened
CWE-209. The SDK embeds authentication credentials in error output under failure conditions. CVSS 7.5, high impact on CIA.
Why it matters
This SDK is the access layer to SAP's AI services. Credential leakage through error output is a low-effort, log-based way for an attacker to obtain tokens that grant access to enterprise AI/LLM capabilities.
Attack vector
Certain internal operations under specific failure conditions generate error messages that inadvertently include sensitive authentication credentials. A low-privileged attacker with access to application logs or forwarded error output can recover them.
Affected systems
SAP Cloud SDK for AI (JavaScript) <= v2.17.0
Mitigation
Upgrade the SAP Cloud SDK for AI (Node.js) past v2.17.0 per GitHub GHSA-8g7j-49xg-8wf3 / SAP Security Patch Day.