SAP pyodata CVE-2026-66773

Exploitation requires the vulnerable application to be configured to connect to an OData service endpoint that the attacker controls or has compromised. The pyodata client must be operating with at least low-privilege credentials (consistent with PR:L in the CVSS vector), meaning an authenticated OData session is in progress. High attack complexity (AC:H) means the attacker cannot directly target arbitrary pyodata installations - they must first achieve a position where they influence the OData service the client connects to, either by operating a malicious service, compromising a third-party OData provider, or performing network-level interception (e.g., DNS spoofing, BGP hijack). Limiting factors: the flaw does not affect applications that only connect to fully trusted, internally controlled OData services with no external exposure; it also does not affect environments where pyodata has been patched to 1.11.2 or later. No user interaction is required once the malicious OData service is in position.

The NVD CVSS 3.1 score of 5.9 (Medium) reflects the realistic threat model accurately: AV:N places the attack over the network, AC:H signals that exploitation requires a specific precondition - the target application must be pointed at a malicious or already-compromised OData service endpoint - and PR:L indicates the application connecting to the OData service must itself be operating with at least low-privilege credentials, consistent with authenticated OData access. The high confidentiality impact (C:H) is well-founded given credential forwarding risk, while I:L captures limited data integrity tampering. No EPSS score was provided in source data, and no CISA KEV listing exists, making this a potential-exploitation rather than confirmed-exploitation scenario. The AC:H requirement significantly reduces opportunistic exploitation risk; attackers must either control the OData backend or successfully perform a man-in-the-middle or DNS/BGP hijack to redirect pyodata's outbound connection. This is a real risk in environments that consume untrusted or third-party OData services, but the attack complexity means it is not trivially scalable.

An attacker who controls a malicious OData service - or who has compromised a legitimate OData backend that the target application trusts - waits for a pyodata-based client application to initiate an authenticated OData request. The malicious service exploits the open redirect flaw in pyodata to cause the client to forward its authentication token or credentials to an attacker-controlled URL. The attacker captures those credentials for reuse and can simultaneously return crafted OData response payloads containing injected data that the application processes as legitimate.