Due to an HTTP Request Smuggling vulnerability in SAP Approuter

SAP Approuter is the Node.js-based reverse proxy fronting apps deployed on SAP BTP (Business Technology Platform) — it terminates external traffic, handles OAuth/UAA login flow, and forwards requests to backing microservices. CVE-2026-27690 is a classic CL.TE / TE.CL desync (CWE-444) where Approuter and its upstream disagree on request boundaries. An unauthenticated attacker sends a crafted request with conflicting Content-Length / Transfer-Encoding framing; the smuggled payload gets prepended to the *next* legitimate user's request on the same keep-alive connection, so the attacker can steal that user's response (session cookies, JWTs, personal data) or poison a shared cache. Affected: Approuter versions < 20.10.0; fix is 20.10.0.

The vendor 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:H) is defensible but slightly overheated. Smuggling here does not give RCE, does not give write-side integrity impact (I:N is honest), and the confidentiality impact is bounded by whatever passes through Approuter — session tokens and app responses, not the SAP database directly. It's a genuine unauth internet-reachable primitive against a component that is *deliberately* internet-exposed, which is why we hold it at HIGH rather than downgrading to MEDIUM.

Why this verdict

• Role multiplier — Approuter IS the identity broker. For BTP-hosted apps, Approuter terminates external TLS, runs the OAuth handshake with xsuaa, and injects the JWT into upstream calls. Smuggling here = session theft on the auth boundary itself. Chain succeeds → tenant-wide session hijack. Floor: HIGH.
• Unauth, network-reachable, low complexity — no prerequisite compromise stage. Attacker needs only a TCP path to the Approuter, and BTP apps are internet-facing by product design (unlike, say, an internal ESXi). Baseline severity is preserved, not downgraded, for exposure.
• Integrity is bounded (I:N). No RCE, no code write, no privilege escalation into SAP kernel. Blast radius is limited to sessions and cached responses that flow through the specific vulnerable Approuter instance — not fleet-scale SAP compromise. This is why we sit at HIGH, not CRITICAL.
• Modern mitigations partially blunt the class. BTP tenants fronted by SAP Web Dispatcher, CloudFront, or Cloudflare with strict HTTP/1.1 normalization will drop conflicting-framing requests before they reach Approuter. HTTP/2 end-to-end (rare but growing) eliminates the vector.
• No KEV, no in-the-wild, no PoC at disclosure — pulls us off CRITICAL to HIGH pending exploitation evidence. If a working PoC lands (expect within 30 days for a class this well-tooled), re-rate to 9.0+.

Why not higher?

CRITICAL requires either integrity/RCE impact or active exploitation of a canonical fleet-owning component. This is C:H/I:N — the attacker reads and disrupts but does not write or execute. No KEV listing, no public PoC on day one, and blast radius is scoped to the individual Approuter's connection pool, not the SAP application server or HANA database behind it.

Why not lower?

MEDIUM is off the table: unauthenticated, network-reachable, low-complexity attack against an internet-facing identity broker that handles OAuth tokens for BTP customer tenants. The role multiplier (Approuter = auth edge) enforces a HIGH floor even without in-the-wild evidence.

1. Upgrade @sap/approuter to 20.10.0 and redeploy affected BTP apps — The only complete fix. cf push or Kyma redeploy after bumping package.json. Deploy within 30 days per noisgate HIGH mitigation SLA; complete fleet rollout within 180 days per remediation SLA.
2. Front Approuter with a strict HTTP/1.1-normalizing proxy — Place SAP Web Dispatcher, Cloudflare, or an AWS ALB with routing.http.drop_invalid_header_fields.enabled=true in front. Reject requests containing both Content-Length and Transfer-Encoding, or with obs-fold / CR-only line endings. Deploy within 30 days.
3. Enable HTTP/2 end-to-end where the upstream supports it — HTTP/2 uses length-prefixed frames — the CL/TE ambiguity does not exist. Kills the class entirely for upgraded connections.
4. Shorten JWT / xsuaa token lifetimes and enforce IP-bound tokens — Reduces the value of any smuggled session capture. Set token-validity to ≤ 3600s and enable x-forwarded-for-bound token issuance in xsuaa config.
5. Instrument Approuter access logs for smuggling signatures — Alert on requests with both CL and TE headers, on 400/408 anomaly spikes, and on duplicate x-vcap-request-id. Push to your SIEM this week.

Run on any host that has the BTP CF CLI installed and is logged into the target org/space. Invoke as ./check-approuter.sh <app-name> — needs read (SpaceDeveloper or higher) on the target space. Emits VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# noisgate: CVE-2026-27690 SAP Approuter version check
# Usage: ./check-approuter.sh <cf-app-name>
set -u
APP="${1:-}"
FIXED="20.10.0"

if [[ -z "$APP" ]]; then
  echo "usage: $0 <cf-app-name>" >&2
  exit 2
fi

if ! command -v cf >/dev/null 2>&1; then
  echo "UNKNOWN: cf CLI not installed" >&2
  exit 3
fi

# Pull the running package.json from the container
VER=$(cf ssh "$APP" -c 'cat /home/vcap/app/package.json 2>/dev/null | \
  grep -oE "\"@sap/approuter\"\s*:\s*\"[^\"]+\"" | \
  grep -oE "[0-9]+\.[0-9]+\.[0-9]+"' 2>/dev/null | head -n1)

if [[ -z "$VER" ]]; then
  # Fallback: check node_modules
  VER=$(cf ssh "$APP" -c 'cat /home/vcap/app/node_modules/@sap/approuter/package.json 2>/dev/null | \
    grep -oE "\"version\"\s*:\s*\"[^\"]+\"" | \
    grep -oE "[0-9]+\.[0-9]+\.[0-9]+"' 2>/dev/null | head -n1)
fi

if [[ -z "$VER" ]]; then
  echo "UNKNOWN: could not read @sap/approuter version from $APP"
  exit 3
fi

# semver compare
lowest=$(printf '%s\n%s\n' "$VER" "$FIXED" | sort -V | head -n1)
if [[ "$VER" == "$FIXED" || "$lowest" == "$FIXED" ]]; then
  echo "PATCHED: $APP running @sap/approuter $VER (>= $FIXED)"
  exit 0
else
  echo "VULNERABLE: $APP running @sap/approuter $VER (< $FIXED)"
  exit 1
fi

Sources

1. SAP Security Patch Day — July 2026
2. SecurityBridge Cloud — SAP Security Notes 2026
3. Cryptika — SAP Security Update July 2026
4. entplexit — SAP Security News 07/2026
5. Onapsis — HTTP Request Smuggling in SAP Web Dispatcher (class background)
6. PortSwigger — HTTP Request Smuggling research
7. SAP Approuter npm package
8. CWE-444 — Inconsistent Interpretation of HTTP Requests