{"id":"CVE-2026-120013","kind":"vulnerability","aliases":["CVE-2026-120013"],"related":[],"title":"agent_memory: tenant parameter allows path traversal into other tenants' secrets","description":"The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value containing path traversal sequences (for example, attacker-corp/../victim-corp) could cause the resolved path to escape the intended directory and access another tenant's secrets under:Plain Text/etc/secrets/appfnd/hana-agent-memory/<tenant>/Successful exploitation could allow unauthorized access to another tenant's mounted credentials, including OAuth client IDs and client secrets. This vulnerability could enable cross-tenant access to sensitive credentials.","summary":"The agent_memory module's create_client function takes a tenant value and builds a file path from it without validation. A crafted value with path traversal sequences lets a caller read another tenant's mounted OAuth client IDs and secrets.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agent_memory","multi-tenant","package","python"],"not_affected_if":["single-tenant","tenant-hardcoded"],"how_to_check":"- Check the installed agent_memory version, for example with `pip show agent_memory` (package name assumed; confirm in your environment)\n- Look for calls to `create_client(tenant=...)` where the tenant value comes from user input or a request\n- Check whether secrets are mounted under `/etc/secrets/appfnd/hana-agent-memory/<tenant>/` on shared hosts","fix":"- Move to a version at or above `0.50.0`, which the sources say is the fixed release","status":"open","published_at":"2026-11-10T09:17:22+00:00","first_seen_at":"2026-11-10T09:21:08+00:00","triaged_at":"2026-11-10T09:21:23+00:00","updated_at":"2026-11-10T09:21:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T09:21:23Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version at or above `0.50.0`, which the sources say is the fixed release","reach":"unknown","title":"agent_memory: tenant parameter allows path traversal into other tenants' secrets","impact":"high","summary":"The agent_memory module's create_client function takes a tenant value and builds a file path from it without validation. A crafted value with path traversal sequences lets a caller read another tenant's mounted OAuth client IDs and secrets.","audience":"developers","category":"package","nicknames":[],"who_cares":["agent_memory","multi-tenant","python"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads another tenant's OAuth client secrets from mounted credentials.","analyst_note":"Confirm the package registry and ecosystem for agent_memory, and whether the vendor advisory linked on GitHub names a different fixed version or a configuration workaround; also confirm whether authentication is required to reach create_client.","how_to_check":"- Check the installed agent_memory version, for example with `pip show agent_memory` (package name assumed; confirm in your environment)\n- Look for calls to `create_client(tenant=...)` where the tenant value comes from user input or a request\n- Check whether secrets are mounted under `/etc/secrets/appfnd/hana-agent-memory/<tenant>/` on shared hosts","plain_action":"","product_name":"agent_memory","needs_analyst":true,"not_affected_if":["single-tenant","tenant-hardcoded"],"who_is_affected":"Teams that run the agent_memory module with a tenant value that can come from outside their own code, on a host where several tenants' secrets are mounted. Deployments with one tenant, or with tenant values fully controlled by trusted code, are less exposed. The sources do not say which framework or ecosystem the package is published under.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000812,"input_tokens":4699,"output_tokens":684,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120013':14A,17A '-2026':13A,16A '/../victim-corp':112C '/successful':132C '0.50.0':84C 'accept':70C 'access':124C,137C,158C 'agent':1A,18B,26B,67C 'allow':5A,135C 'anoth':57B,125C,139C 'attack':110C 'attacker-corp':109C 'build':38B 'caller':55B,73C 'caller-suppli':72C 'caus':114C 'client':31B,62B,79C,146C,149C 'construct':95C 'contain':103C 'corp':111C 'could':113C,134C,153C 'craft':47B 'creat':30B,78C 'credenti':143C,161C 'cross':156C 'cross-ten':155C 'cve':12A,15A 'directori':122C 'enabl':154C 'escap':119C 'exampl':108C 'exploit':133C 'file':40B 'filesystem':96C 'function':32B 'id':63B,147C 'includ':144C 'intend':121C 'let':53B 'memori':2A,19B,27B,68C 'modul':28B,69C 'mount':60B,142C 'multi':21B 'multi-ten':20B 'oauth':61B,145C 'packag':23B 'paramet':4A,76C,87C 'path':6A,41B,50B,97C,104C,117C 'plain':130C 'prior':81C 'python':24B 'read':56B 'resolut':100C 'resolv':116C 'secret':11A,65B,99C,128C,150C 'sensit':160C 'sequenc':52B,106C 'suppli':74C 'take':33B 'tenant':3A,10A,22B,35B,58B,75C,80C,86C,126C,140C,157C 'text/etc/secrets/appfnd/hana-agent-memory':131C 'travers':7A,51B,105C 'unauthor':136C 'use':93C 'valid':45B,90C 'valu':36B,48B,102C 'version':83C 'vulner':152C 'without':44B","nicknames":[],"mitigations":[],"who_affected":"Teams that run the agent_memory module with a tenant value that can come from outside their own code, on a host where several tenants' secrets are mounted. Deployments with one tenant, or with tenant values fully controlled by trusted code, are less exposed. The sources do not say which framework or ecosystem the package is published under.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["agentmemory","high","multitenant","package","python"],"campaign_type":null,"search_a":"'-120013':14A,17A '-2026':13A,16A 'agent':1A 'allow':5A 'cve':12A,15A 'memori':2A 'paramet':4A 'path':6A 'secret':11A 'tenant':3A,10A 'travers':7A","search_b":"'agent':18B,26B 'anoth':57B 'build':38B 'caller':55B 'client':31B,62B 'craft':47B 'creat':30B 'file':40B 'function':32B 'id':63B 'let':53B 'memori':19B,27B 'modul':28B 'mount':60B 'multi':21B 'multi-ten':20B 'oauth':61B 'packag':23B 'path':41B,50B 'python':24B 'read':56B 'secret':65B 'sequenc':52B 'take':33B 'tenant':22B,35B,58B 'travers':51B 'valid':45B 'valu':36B,48B 'without':44B","search_c":"'/../victim-corp':112C '/successful':132C '0.50.0':84C 'accept':70C 'access':124C,137C,158C 'agent':67C 'allow':135C 'anoth':125C,139C 'attack':110C 'attacker-corp':109C 'caller':73C 'caller-suppli':72C 'caus':114C 'client':79C,146C,149C 'construct':95C 'contain':103C 'corp':111C 'could':113C,134C,153C 'creat':78C 'credenti':143C,161C 'cross':156C 'cross-ten':155C 'directori':122C 'enabl':154C 'escap':119C 'exampl':108C 'exploit':133C 'filesystem':96C 'id':147C 'includ':144C 'intend':121C 'memori':68C 'modul':69C 'mount':142C 'oauth':145C 'paramet':76C,87C 'path':97C,104C,117C 'plain':130C 'prior':81C 'resolut':100C 'resolv':116C 'secret':99C,128C,150C 'sensit':160C 'sequenc':106C 'suppli':74C 'tenant':75C,80C,86C,126C,140C,157C 'text/etc/secrets/appfnd/hana-agent-memory':131C 'travers':105C 'unauthor':136C 'use':93C 'valid':90C 'valu':102C 'version':83C 'vulner':152C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:10:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120013","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120013","severity":null,"published_at":"2026-11-10T09:17:22+00:00","modified_at":"2026-11-10T09:17:22+00:00","first_seen_at":"2026-11-10T09:21:08+00:00","fetched_at":"2026-11-10T09:21:08+00:00","note":null}],"documents":[{"id":114129,"url":"https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-28c8-457r-4cf6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T00:10:50+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}