CVE-2026-27690: SAP Approuter HTTP Request Smuggling Flaw

CVE-2026-27690 Overview

CVE-2026-27690 is an HTTP Request Smuggling vulnerability [CWE-444] in SAP Approuter. An unauthenticated remote attacker can send a specially crafted HTTP request that causes request-response desynchronization between front-end and back-end servers. Successful exploitation exposes user responses to attacker-controlled sessions and can render the affected system unavailable.

The flaw carries a network attack vector, requires no privileges, and needs no user interaction. Impact is high on confidentiality and availability, with no impact on integrity.

Critical Impact
Attackers can hijack in-flight user responses, steal session data, and knock SAP Approuter deployments offline without authentication.

Affected Products

SAP Approuter (specific version list not published in NVD data)
Deployments fronting SAP Business Technology Platform (BTP) applications through Approuter
Any SAP Cloud Foundry application relying on Approuter for routing

Discovery Timeline

2026-07-14 - CVE-2026-27690 published to NVD
2026-07-14 - SAP publishes Security Note #3720138 on SAP Security Patch Day
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-27690

Vulnerability Analysis

SAP Approuter is a Node.js-based reverse proxy that fronts SAP Business Technology Platform applications, handling authentication and routing to back-end services. HTTP Request Smuggling occurs when a front-end proxy and a back-end server disagree on where one HTTP request ends and the next begins.

An unauthenticated attacker sends a crafted request combining conflicting Content-Length and Transfer-Encoding headers, or otherwise ambiguous framing. The proxy forwards what it treats as one request, while the back-end interprets the payload as two. The smuggled second request is then prepended to the next legitimate user's connection.

The consequence is request-response desynchronization. A victim's response can be delivered to the attacker, exposing session cookies, bearer tokens, and application data. Repeated abuse also drives the routing layer into an unrecoverable state, producing denial of service.

Root Cause

The root cause is inconsistent parsing of HTTP message framing between SAP Approuter and its upstream targets. Approuter does not sufficiently normalize or reject conflicting length indicators before forwarding the request, violating [RFC 7230] guidance that ambiguous framing must terminate the connection.

Attack Vector

Exploitation requires only network reachability to the Approuter endpoint. The attacker crafts an HTTP/1.1 request that Approuter parses as one message and the back-end parses as two. The smuggled prefix targets the next user's connection on a pooled keep-alive channel. No credentials, tokens, or user interaction are needed.

The vulnerability sees an EPSS score of 0.539% with a percentile of 41.8, indicating moderate but non-negligible near-term exploitation probability.

No public proof-of-concept has been published at the time of writing. Refer to SAP Note #3720138 for vendor technical details.

Detection Methods for CVE-2026-27690

Indicators of Compromise

HTTP requests to Approuter containing both Content-Length and Transfer-Encoding: chunked headers
Requests with duplicated Content-Length values or malformed chunked encoding
Approuter access logs showing responses delivered to unexpected client IPs or session identifiers
Unexplained 400/408/502 spikes correlated with elevated back-end latency

Detection Strategies

Inspect reverse proxy and load balancer logs for ambiguous request framing patterns
Correlate mismatches between Approuter access logs and back-end application logs on the same connection ID
Deploy a web application firewall rule to flag or block requests carrying conflicting length headers
Baseline normal Approuter connection reuse behavior and alert on session-token cross-contamination

Monitoring Recommendations

Enable verbose HTTP header logging on Approuter and upstream services for the duration of the response effort
Forward Approuter, load balancer, and back-end application logs into a centralized analytics platform for cross-layer correlation
Monitor for repeated 400-series errors from a single source IP that precede successful authenticated responses

How to Mitigate CVE-2026-27690

Immediate Actions Required

Apply the SAP-supplied fix documented in SAP Note #3720138 as the primary remediation
Upgrade @sap/approuter to the fixed version published on SAP Security Patch Day July 2026
Restrict inbound access to Approuter endpoints to trusted networks where operationally feasible
Audit recent Approuter logs for signs of prior smuggling attempts and session hijack indicators

Patch Information

SAP released the fix on July 2026 Security Patch Day. Detailed version guidance is available in SAP Note #3720138 and on the SAP Security Patch Day portal. Customers running Approuter through npm should update the @sap/approuter package and redeploy affected Cloud Foundry applications.

Workarounds

Place a hardened HTTP/1.1-compliant reverse proxy in front of Approuter to reject ambiguous framing
Disable HTTP/1.1 keep-alive on upstream connections where performance impact is acceptable, reducing smuggling reliability
Enforce strict WAF rules that drop requests containing both Content-Length and Transfer-Encoding headers

bash

# Example WAF rule concept (ModSecurity-style)
SecRule REQUEST_HEADERS:Content-Length "@rx ." \
  "chain,id:1027690,phase:1,deny,status:400,msg:'HTTP Request Smuggling attempt (CVE-2026-27690)'"
  SecRule REQUEST_HEADERS:Transfer-Encoding "@rx chunked"