https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 12 Nov 2026 03:12:49 +0000 https://db.gcve.eu/vuln/cve-2026-120013 <p><strong>Affected:</strong> SAP_SE SAP Cloud SDK for Python</p> <p>The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value containing path traversal sequences (for example, attacker-corp/../victim-corp) could cause the resolved path to escape the intended directory and access another tenant&#39;s secrets under:Plain Text/etc/secrets/appfnd/hana-agent-memory/&lt;tenant&gt;/Successful exploitation could allow unauthorized access to another tenant&#39;s mounted credentials, including OAuth client IDs and client secrets. This vulnerability could enable cross-tenant access to sensitive credentials.</p> <p><strong>Affected:</strong> SAP_SE SAP Cloud SDK for Python</p> <p>The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value containing path traversal sequences (for example, attacker-corp/../victim-corp) could cause the resolved path to escape the intended directory and access another tenant&#39;s secrets under:Plain Text/etc/secrets/appfnd/hana-agent-memory/&lt;tenant&gt;/Successful exploitation could allow unauthorized access to another tenant&#39;s mounted credentials, including OAuth client IDs and client secrets. This vulnerability could enable cross-tenant access to sensitive credentials.</p> https://db.gcve.eu/vuln/cve-2026-120013