CVE-2026-120013

The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...).

The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value containing path traversal sequences (for example, attacker-corp/../victim-corp) could cause the resolved path to escape the intended directory and access another tenant's secrets under:Plain Text/etc/secrets/appfnd/hana-agent-memory/…

10. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-120013