Summary: Security researchers have uncovered multiple vulnerabilities in SAP AI Core that pose significant risks related to tenant isolation and data security. These flaws could allow attackers to execute arbitrary code, access sensitive customer data, and manipulate internal resources.
Threat Actor: Unknown | unknown
Victim: SAP | SAP
Key Point :
- Vulnerabilities in SAP AI Core could allow attackers to execute arbitrary code and access sensitive customer data.
- Exploits included unauthorized access to AWS secrets and the ability to read and modify Docker images.
- An unauthenticated Helm server was discovered, posing risks of supply-chain attacks on SAP’s infrastructure.
- All identified vulnerabilities were reported to SAP and have been fixed, with no customer data confirmed as compromised.
- The research highlights the need for robust security measures in AI R&D processes to protect against untrusted code execution.

Security researchers have identified several vulnerabilities in SAP AI Core, a platform that enables users to develop, train and run AI services.
These vulnerabilities, found by Wiz and discussed in an advisory published on Wednesday, highlight significant risks associated with tenant isolation in AI infrastructure.
In particular, the investigation into SAP AI Core revealed that attackers could execute arbitrary code, allowing them to access sensitive customer data and cloud credentials. This breach could enable malicious actors to manipulate internal artifacts, impacting related services and other customer environments.
Wiz’s findings showed that it was possible to read and modify Docker images on SAP’s internal container registry and Google’s Container Registry, gain cluster administrator privileges on SAP AI Core’s Kubernetes cluster, and access customers’ cloud credentials and private AI artifacts.
Read more on AI in cybersecurity: OpenAI’s ChatGPT is Breaking GDPR, Says Noyb
The research began with standard AI training procedures on SAP’s infrastructure, which allowed the execution of arbitrary code. This capability allowed the team to bypass network restrictions and exploit several configurations the admission controller did not block.
These exploits enabled access to sensitive tokens and configurations, leading to further vulnerabilities, such as unauthorized access to AWS secrets stored in Grafana Loki’s configuration, and exposing files on AWS Elastic File System instances.
Additionally, the team discovered an unauthenticated Helm server, which provided access to highly privileged secrets for SAP’s Docker Registry and Artifactory server. This access posed a risk of supply-chain attacks, where attackers could poison images and builds. The most critical vulnerability they uncovered was the ability to gain full cluster-admin privileges on the Kubernetes cluster, allowing access to other customers’ data and secrets.
All identified vulnerabilities were reported to SAP and have since been fixed. SAP confirmed that no customer data was compromised.
“This research demonstrates the unique challenges that the AI R&D process introduces,” Wiz said. “AI training requires running arbitrary code by definition; therefore, appropriate guardrails should be in place to assure that untrusted code is properly separated from internal assets and other tenants.”
Image credit: Wirestock Creators / Shutterstock.com
Source: https://www.infosecurity-magazine.com/news/sap-ai-core-expose-customer-data
“An interesting youtube video that may be related to the article above”