SAP_SE SAP Cloud SDK for Python vulnerabilities

Latest SAP_SE SAP Cloud SDK for Python CVEs

Newest publication first

1. CVE-2026-120013 Path Traversal in Agent Memory Module of SAP Cloud SDK for Python

   Published 2026-11-10

   High·CVSS 7.5 EPSS 0.45%

   The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value containing path traversal sequences (for...

2. CVE-2026-109799 Improper verification of JWT signature in IASContextProvider leads to tenant/user identity spoofing ( sap-cloud-sdk (pip))

   Published 2026-11-10

   High·CVSS 7.5 EPSS 0.17%

   The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in IASContextProvider, the runtime-context provider registered by default via bootstrap(app).IASContextProvider extracted the app_tid, sap_gtid and user_uuid claims from...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.