CVE-2026-58239: SAP Approuter Information Disclosure

CVE-2026-58239 Overview

CVE-2026-58239 affects SAP Approuter, a component that routes HTTP requests to backend services in multi-tenant SAP Business Technology Platform deployments. The vulnerability stems from insufficient validation of tenant context in inbound requests. An unauthenticated attacker can send specially crafted requests to spoof the tenant context. Successful exploitation allows limited access to another tenant's information, resulting in a low impact on confidentiality. Integrity and availability are not affected. The weakness is tracked as [CWE-807] (Reliance on Untrusted Inputs in a Security Decision). Exploitation requires conditions not fully within the attacker's control, contributing to a high attack complexity rating.

Critical Impact
Unauthenticated attackers can spoof tenant context to gain limited read access to another tenant's data in multi-tenant SAP Approuter deployments.

Affected Products

SAP Approuter (specific version ranges published in SAP Note #3786038)
Multi-tenant SAP Business Technology Platform applications using Approuter
Cloud Foundry and Kubernetes deployments relying on Approuter for tenant routing

Discovery Timeline

2026-08-11 - CVE-2026-58239 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-58239

Vulnerability Analysis

SAP Approuter serves as the entry point for multi-tenant applications, forwarding requests to backend services based on tenant identifiers derived from the incoming request. The router extracts tenant context from request attributes such as hostnames, subdomains, or HTTP headers. It then uses this context to route the request and to scope subsequent authorization decisions.

CVE-2026-58239 is a tenant context validation flaw. The router accepts tenant identifiers from inbound request attributes without sufficient cross-checks against trusted signals. This weakness maps to [CWE-807], where a security decision relies on untrusted input. An attacker can craft requests that assert a tenant identity different from the caller's actual context.

Because the flaw allows limited read access only, exploitation returns fragments of another tenant's data rather than full account takeover. No authentication is required, but exploitation depends on environmental conditions such as specific routing configurations and tenant naming patterns.

Root Cause

The root cause is improper reconciliation between the tenant identifier presented in an inbound request and the trusted tenant context established by authenticated session data or platform metadata. Approuter treats the attacker-controlled input as authoritative for routing and access scoping.

Attack Vector

The attack is remote and unauthenticated over the network. An attacker submits an HTTP request containing manipulated tenant-context indicators, such as forged host headers or path prefixes. The router forwards the request under the spoofed tenant scope, returning information belonging to that tenant. Detailed technical parameters and vulnerable configurations are documented in the SAP Note #3786038.

Detection Methods for CVE-2026-58239

Indicators of Compromise

Inbound HTTP requests where the Host header, x-forwarded-host, or tenant subdomain does not match the authenticated session's tenant claim.
Approuter access logs showing repeated 200-status responses to unauthenticated requests targeting tenant-scoped endpoints.
Backend audit logs reporting cross-tenant data reads without a corresponding user login event.

Detection Strategies

Compare tenant identifiers in Approuter routing logs against JWT tid or zid claims from downstream services and alert on divergence.
Baseline per-tenant request volume and flag sudden spikes in unauthenticated traffic to /api/ or /rest/ routes.
Correlate SAP Cloud Foundry audit events with Approuter logs to surface tenant scope changes that occur without user authentication.

Monitoring Recommendations

Forward Approuter and SAP BTP audit logs to a centralized data lake for cross-tenant correlation.
Monitor for anomalous Host header values and inconsistent x-forwarded-* header chains at the ingress layer.
Enable verbose tenant routing logs during the patch validation window to confirm correct tenant resolution.

How to Mitigate CVE-2026-58239

Immediate Actions Required

Apply the patch referenced in SAP Note #3786038 to all Approuter instances across production and non-production tenants.
Inventory every Approuter deployment, including those embedded in custom BTP applications, and confirm the fixed version is running.
Review Approuter access logs for the past 90 days for cross-tenant request patterns described above.

Patch Information

SAP published the fix on SAP Security Patch Day. Full remediation details, including affected versions and upgrade paths, are provided in SAP Note #3786038 and summarized on the SAP Security Patch Day portal. Customers should upgrade Approuter dependencies in their package.json and redeploy affected applications.

Workarounds

Enforce strict Host header validation at the ingress or load-balancer layer in front of Approuter until patches are deployed.
Restrict tenant subdomain wildcards and require explicit allowlists for accepted tenant identifiers.
Enable additional server-side tenant claim verification in backend services so that Approuter is not the sole authority for tenant scoping.

bash

# Example: enforce Host header allowlist at ingress before Approuter
# nginx snippet
map $host $tenant_allowed {
    default                     0;
    "tenant-a.example.com"      1;
    "tenant-b.example.com"      1;
}

server {
    listen 443 ssl;
    if ($tenant_allowed = 0) {
        return 403;
    }
    location / {
        proxy_set_header Host $host;
        proxy_pass http://approuter_upstream;
    }
}