Description

SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information. This results in a low impact on confidentiality. There is no impact on integrity and availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-11T01:17:24.283Z",
  "pubdate": "2026-08-11T01:17:24.283Z",
  "executiveSummary": "SAP Approuter is affected by an insufficient input sanitization vulnerability involving specific HTTP request headers.\nThe vulnerability allows an unauthenticated remote attacker to construct and transmit specially crafted HTTP requests, resulting in limited unauthorized access to sensitive information.\nThe security impact is strictly confined to confidentiality, with no associated effects on system integrity or availability.\nDue to the requirement of network exposure and the low impact profile, the overall risk is categorized as low.\nThe root cause stems from improper validation and sanitization of incoming header data prior to proxying and forwarding traffic to internal backend components.",
  "technicalDetails": "The vulnerability resides within the SAP Approuter component, specifically in the logic responsible for processing, normalizing, and forwarding HTTP request headers to downstream internal microservices and components.\nThe root cause is inadequate sanitization of untrusted input supplied via HTTP request headers, allowing malicious or malformed values to bypass boundary checks.\nAn unauthenticated attacker positioned on the network can exploit this flaw by sending a specially crafted HTTP request containing malicious header payloads directly to the exposed SAP Approuter endpoint.\nUpon receipt, the vulnerable Approuter proxy fails to adequately cleanse the headers and propagates them to internal backend services.\nThe internal component interprets the unsanitized headers improperly, leading to exposure of restricted contextual data or limited unauthorized information disclosure to the client.\nThe attack vector is network-based and requires no prior authentication or elevated privileges, relying solely on the ability to reach the SAP Approuter instance over the network.\nPost-exploitation impact is limited to the retrieval of specific unauthorized information accessible through the misdirected or improperly handled headers, with no capability to modify data, execute arbitrary code, or cause denial-of-service conditions."
}