SAPwned: SAP AI vulnerabilities expose customers’ cloud environments and private AI artifacts

Wiz Research performed tenant isolation testing on SAP AI Core and discovered a chain of vulnerabilities (including process-namespace sharing, misconfigured UIDs, exposed Istio tokens, leaked AWS credentials from Loki, unauthenticated EFS shares, and an exposed Helm/Tiller server) that enabled arbitrary code execution to escalate into cluster admin access, read/write access to internal registries and artifactory, and access to customer cloud credentials and AI artifacts; the findings were disclosed to SAP, patched, and no customer data compromise was reported.