Non-destructive detection and precondition-verification tool for CVE-2026-58231, probing SAP Commerce Cloud Data Hub endpoints, default OAuth clients, and authorization boundaries.
Detection and precondition-verification tool for CVE-2026-58231 — improper authorization in the Data Hub Adapter component of SAP Commerce Cloud (CVSS 10.0).
The script performs non-destructive checks only. It does not ship or execute any code-injection payload.
CVE-2026-58231 allows an unauthenticated remote attacker to abuse a default authentication client and submit crafted input to insufficiently validated functions of the Data Hub Adapter, potentially resulting in arbitrary code execution.
| Field | Value |
|---|
| Product | SAP Commerce Cloud — Data Hub Adapter |
| Affected branches | COM_CLOUD 2211, COM_CLOUD 2211-JDK21 |
| Fixed releases | 2211.55, 2211-jdk21.17 |
| CWE | CWE-94 (Code Injection) |
| CVSS 3.1 | 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) |
| Vendor advisory | SAP Security Note 3771065 |
/hac/, /backoffice/, Spring OAuth authorization server)./datahubadapter/* paths to determine whether the import interface is reachable.| Verdict | Meaning |
|---|---|
PASS | Check negative — control present / surface absent |
INFO | Neutral fingerprint information |
WARN | Adapter surface exposed, behavior inconclusive |
HIGH | Default-client token accepted where anonymous is rejected |
CRIT | Documented exploitation preconditions met |
Verdicts are deliberately conservative: a positive result confirms preconditions described in the advisory, not full compromise. Confirming end-to-end impact requires the vendor patch-diff workflow (SAP Note 3771065, compare datahubadapter 2211.54 vs 2211.55).
pip install requests
Python 3.8+
python3 cve-2026-58231-detect.py https://target.example --i-am-authorized
python3 cve-2026-58231-detect.py https://target.example --i-am-authorized --timeout 15 --delay 0.8
python3 cve-2026-58231-detect.py https://target.example --i-am-authorized --json findings.json
| Flag | Description |
|---|---|
--i-am-authorized | Required. Confirms lawful authorization to test the target. |
--timeout | Per-request timeout in seconds (default: 10). |
--delay | Delay between requests in seconds (default: 0.4). |
--json | Write structured results to a file. |
[ INFO] Version headers: {"Server": "sap-commerce"}
[ OK] Commerce fingerprint: no strong SAP Commerce indicators
[ PASS] Exposure: all /datahubadapter/* paths 404
[ PASS] Default auth client: 'datahub' rejected (401)
[ PASS] Auth boundary: import endpoint 404, skipped
Target : https://target.example
Verdict : INFO
Reference: SAP Note 3771065 | fixed in 2211.55 / 2211-jdk21.17
/datahubadapter/import/** to trusted Data Hub addresses via IP Filter Set.This tool is provided for authorized security testing and lawful vulnerability management purposes only.
By using this software you represent and warrant that:
The script performs non-destructive network requests only. It ships no exploit payload. Nevertheless, unauthorized scanning of third-party infrastructure is illegal regardless of tooling intent.
No warranty. This software is distributed under the MIT License "AS IS", without warranty of any kind. The author assumes no liability for damages, legal consequences, or misuse resulting from its use. Users bear full responsibility for their actions.