Quick answers
- Is CVE-2026-58230 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-58230 being exploited in the wild.
- How severe is CVE-2026-58230?
- High severity, with a CVSS score of 7, published 11 August 2026.
- Which products and versions are affected?
- @sap/approuter (npm) < 23.0.0, SEMVER:introduced=0,fixed=23.0.0.
- Is there a fix for CVE-2026-58230?
- Yes. @sap/approuter (npm): upgrade to 23.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-58230 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-58230?
- Check whether you run @sap/approuter (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- @sap/approuter (npm): upgrade to 23.0.0 or later
npm install @sap/approuter@23.0.0
Technical details
The vulnerability is rooted in inadequate token validation in SAP Approuter, specifically related to URL redirection (CWE-601). An unauthenticated attacker can craft a malicious token that, under non-default configurations, causes the application to redirect sensitive credential material (such as authentication tokens, API keys, or session data) to an attacker-controlled endpoint. The attack vector is network-based and requires no user interaction, but attack complexity is rated high due to environmental preconditions (non-standard configuration) that must be present. An attacker exploiting this vulnerability would achieve unauthorized access to confidential credential material. Versions prior to 23.0.0 are affected; SAP released patch version 23.0.0 on August 11, 2026.
Affected products
- SAP @sap/approuter < 23.0.0
Identifiers
- CVE-2026-58230
- GHSA-vhh6-v828-x62f
Timeline
- 2026-08-11: disclosed
- 2026-08-11: patched: Version 23.0.0 released