CVE-2026-76969 Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)
Unauthenticated attackers can obtain sensitive credentials in multitenant SAP CAP applications with extensibility enabled, leading to data modification and partial confidentiality loss.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-76969?
CVE-2026-76969 is a critical vulnerability in SAP_SE SAP Cloud Application Programming Model (CAP), published on 8 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application. There may also be partial impact to the confidentiality of business data.
Weakness: CWE-522
Which versions are affected by CVE-2026-76969?
8 open source packages ship an affected version, including @sap/cds-mtxs.
| Package | Affected | Fixed in |
|---|---|---|
@sap/cds-mtxs npm | All versions | 1.18.4 |
@sap/cds-mtxs npm | All versions | 1.18.4 |
@sap/cds-mtxs npm | From 2.0.2 | 2.7.7 |
@sap/cds-mtxs npm | From 2.0.2 | 2.7.7 |
@sap/cds-mtxs npm | From 3.0.1 | 3.9.7 |
@sap/cds-mtxs npm | From 3.0.1 | 3.9.7 |
2 more packages
@sap/cds-mtxs npm | From 4.0.1 | 4.0.3 |
@sap/cds-mtxs npm | From 4.0.1 | 4.0.3 |
How do I fix CVE-2026-76969?
Upgrade @sap/cds-mtxs to a fixed version for your release line: 1.18.4, 2.7.7, 3.9.7 or 4.0.3.
Is CVE-2026-76969 being exploited?
There is no known exploitation of CVE-2026-76969 in the wild and no public exploit code.
Sources
Also known as GHSA-955m-rr6m-2f9v.