CVE-2026-66773

MediumCVSS 5.9/10Last modified Oct 24, 2026

Description

A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
SAP_SE	Odata	pyodata (pip) < 1.11.2

References

Timeline

Published: Aug 11, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-667743.7SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default CVE-2026-667754.3SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker coul CVE-2026-667765.9SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An CVE-2026-667775.9SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity CVE-2026-667785.3SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated at CVE-2026-667796.3Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malic CVE-2026-66785.3Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other Recipient Info, leading to incorrect length handling during decryption.CVE-2026-667806.5A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, posse CVE-2026-667815.4A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPse CVE-2026-667825.8A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer t CVE-2026-667834.4A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a c CVE-2026-667858.7A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clust