CVE-2026-66773 Overview
CVE-2026-66773 affects the SAP python-pyodata client library. A malicious or compromised OData service can disclose sensitive authentication information from client applications and inject untrusted data into the calling application. The flaw is classified under CWE-601: URL Redirection to Untrusted Site, indicating that the client follows server-supplied URLs without sufficient validation. Successful exploitation results in high impact on confidentiality and limited impact on integrity. Applications that consume OData feeds from external or federated endpoints are the primary risk surface.
Critical Impact
A hostile OData endpoint can harvest client authentication material and feed manipulated data back into consuming Python applications built on python-pyodata.
Affected Products
- SAP python-pyodata client library
- Python applications embedding python-pyodata for OData v2 consumption
- Downstream SAP integrations relying on the affected library versions
Discovery Timeline
- 2026-08-11 - CVE-2026-66773 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-66773
Vulnerability Analysis
The python-pyodata library acts as a Python client for OData services, handling metadata parsing, request construction, and response processing. The library trusts URLs and redirect targets returned by the remote OData service. When a client is directed to a malicious or compromised endpoint, that endpoint can steer subsequent requests to attacker-controlled hosts. Authentication headers, session tokens, or bearer credentials attached to those requests are then transmitted to the untrusted destination. The same flow also allows the server to inject untrusted response data that the application consumes as if it originated from a legitimate OData feed. The attack requires network reachability and low privileges on the client side, and the high attack complexity reflects the need to control or compromise an OData service the target already communicates with.
Root Cause
The root cause is insufficient validation of server-supplied URLs and redirect targets within the OData client. Because [CWE-601] governs untrusted redirection, the client does not enforce a strict allowlist of hosts or scopes before following links returned by the service, allowing credential-bearing requests to flow to attacker-controlled destinations.
Attack Vector
Exploitation requires an attacker to operate or compromise an OData service that a python-pyodata client contacts. The attacker returns crafted metadata or response payloads that redirect the client to a hostile endpoint. Because the client retains and replays authentication material, that material is disclosed to the attacker. The attacker can also return manipulated entity data that the consuming application treats as trusted, enabling limited integrity impact.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-hc5j-q32w-c25v for maintainer-provided technical details.
Detection Methods for CVE-2026-66773
Indicators of Compromise
- Outbound HTTPS requests from Python application hosts to OData endpoints outside the approved integration allowlist.
- Authentication headers or bearer tokens observed in traffic to unexpected external hostnames.
- OData responses containing redirect URLs or @odata.context values pointing to domains not owned by the intended service.
Detection Strategies
- Inventory Python services that import pyodata and correlate outbound destinations with an approved OData service list.
- Inspect proxy and egress logs for redirect chains originating from OData transactions.
- Alert on TLS SNI values from application hosts that do not match sanctioned SAP or partner endpoints.
Monitoring Recommendations
- Forward application, proxy, and DNS telemetry to a central analytics platform for correlation across OData client hosts.
- Track library versions of python-pyodata across the fleet and flag hosts running vulnerable releases.
- Monitor for anomalous authentication reuse patterns, such as the same token appearing across unrelated hostnames within short windows.
How to Mitigate CVE-2026-66773
Immediate Actions Required
- Upgrade python-pyodata to the fixed version referenced in the GitHub Security Advisory.
- Restrict egress from application hosts so that OData clients can only reach approved service endpoints.
- Rotate any credentials or tokens that were used by clients communicating with untrusted or third-party OData services.
Patch Information
Refer to the GitHub Security Advisory GHSA-hc5j-q32w-c25v and the SAP Security Patch Day announcement for the fixed release and vendor guidance. Update dependency manifests (requirements.txt, pyproject.toml, Pipfile) and rebuild affected container images.
Workarounds
- Configure the OData client to communicate only with pinned, internal hostnames and reject responses containing redirect URLs to external domains.
- Terminate OData traffic through an authenticated forward proxy that enforces host allowlists and strips credentials on cross-domain redirects.
- Scope service credentials narrowly and short-lived so that disclosure yields minimal downstream access.
# Upgrade the affected library and pin the fixed version
pip install --upgrade 'pyodata>=<fixed-version>'
pip freeze | grep -i pyodata
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
