What is the CVSS score of CVE-2026-66778?

CVE-2026-66778 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-66778?

Yes, a patch is available for CVE-2026-66778. Update the affected software to the latest version immediately.

SAP Approuter CVE-2026-66778

EUVD-2026-55890 MEDIUM

Improper Neutralization of HTTP Headers for Scripting Syntax (CWE-644)

2026-08-11 sap

GHSA-h7cr-m88c-98m3

Authentication Bypass SAP Sap Business Ai Platform Approuter Sap Se

5.3

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible proxy exploitable with no authentication; only bounded partial information disclosure with no integrity or availability impact confirms C:L, I:N, A:N and S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (sap).

CVSS VectorVendor: sap

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 01:14 vuln.today

Patch available

Aug 11, 2026 - 01:02 EUVD

DescriptionCVE.org

SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information. This results in a low impact on confidentiality. There is no impact on integrity and availability.

AnalysisAI

Header injection in SAP Approuter (the Node.js package for SAP Business AI Platform) allows unauthenticated remote attackers to send specially crafted requests that bypass header sanitization, resulting in limited unauthorized information disclosure from internal backend components. All SAP Approuter Node.js package versions below 23.0.0 are affected, with a vendor-released patch available at version 23.0.0. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the zero-authentication requirement and low attack complexity make it accessible to opportunistic actors targeting exposed SAP BTP deployments.

Technical ContextAI

SAP Approuter is a Node.js-based reverse proxy and application router component within the SAP Business AI Platform (SAP BTP). It serves as the primary ingress point for incoming HTTP(S) traffic, routing requests to appropriate backend microservices while handling authentication delegation, authorization, and session management. The root cause is CWE-644 (Improper Neutralization of HTTP Headers for Scripting Syntax): the Approuter fails to adequately sanitize or filter certain HTTP request headers before forwarding them to downstream internal services. This class of flaw enables header injection, where attacker-controlled header values propagate into backend requests and may override internal access-control signals, spoof trusted internal routing markers, or expose internal service responses. The affected CPE is cpe:2.3:a:sap_se:sap_business_ai_platform_(approuter):*:*:*:*:*:*:*:*, covering all SAP Approuter Node.js package versions prior to 23.0.0. Because the Approuter is the trust boundary between the public internet and internal BTP microservices, header-handling flaws at this layer have disproportionate potential relative to their CVSS score.

RemediationAI

The primary fix is to upgrade the SAP Approuter Node.js package to version 23.0.0 or later, as confirmed by ENISA EUVD-2026-55890 and SAP Security Note 3786038 (https://me.sap.com/notes/3786038); additional context is available via the SAP Security Patch Day advisory page at https://url.sap/sapsecuritypatchday. For deployments where immediate upgrading is not feasible, a compensating control is to place a WAF or edge proxy ahead of the Approuter that strips, normalizes, or rejects unexpected or internal-routing HTTP headers (such as X-Forwarded-* variants or custom SAP internal headers) before they reach the Approuter - note that aggressive header stripping may interfere with legitimate reverse-proxy chains and must be tested against the application's normal header-passing behavior. Additionally, restricting public network reachability of the Approuter endpoint to known trusted IP ranges or VPN clients reduces the attacker population during the patch window. No workaround addresses the root cause; upgrading to version 23.0.0 is the only confirmed remediation.