Credential Exposure in CAP Multitenant Extension Library
SAP Cloud Application Programming Model (CAP)
BTP-specific but the blast radius depends on whether you have multitenant CAP apps with cds-mtxs. If you do, exposed credentials could be used to access customer tenant data across tenants — a serious breach scenario for SaaS shops. SAP has partly mitigated at the platform layer but the library update and redeploy is non-negotiable. Check your npm lock files to confirm which version you are running.
Vulnerability Detail
Sensitive service binding credentials exposed via specially crafted requests in multitenant CAP applications using the cds-mtxs library. SAP BTP Cloud Foundry has blocked affected endpoints at the platform level, but customers must update the library and redeploy their applications.
Patch Action
Update @sap/cds-mtxs to the patched version per SAP Note 3798315, rebuild, and redeploy all affected multitenant CAP applications. Platform-level blocking is not a complete fix — library update and redeploy required.
Affected Versions
Patch Info