CVE-2026-58230

Executive Summary

CVE-2026-58230 is an unpatched vulnerability in the SAP Approuter component affecting enterprise SAP deployments that use the Approuter as an application gateway or single-page application host. The flaw allows an unauthenticated remote attacker to craft a malicious token that, when processed by an insufficiently-validating Approuter configuration, causes sensitive credential material (e.g., OAuth client secrets, session tokens, or backend credentials) to be exfiltrated to an attacker-controlled destination. The vulnerability carries a CVSS score of 7.0 (High) driven primarily by high confidentiality impact, though successful exploitation requires non-default configuration preconditions, raising the attack complexity to High. No patch is currently available, and there are no known public exploits or indicators of active in-the-wild exploitation (CISA KEV: NO, EPSS 0.00243 — negligible weaponization probability at this time).

Technical Analysis

The vulnerability resides in SAP Approuter's token validation logic. SAP Approuter is a core component in SAP Business Technology Platform (BTP) and cloud deployments, acting as a reverse proxy that routes requests from browser clients to backend SAP applications (e.g., Fiori, SAPUI5). It is responsible for token exchange, session management, and communicating with the SAP Authorization and Trust Management service (XSUAA).

According to the NVD description, the root cause is a failure to "sufficiently validate certain token content under specific configurations." The vulnerability is classified under CWE-601 (URL Redirection to Untrusted Site — "Open Redirect"). In this context, an open redirect flaw manifests as a token content validation deficiency: a token carrying a crafted redirect URL or destination claim is accepted by the Approuter without adequate verification. Under such conditions, a malicious actor can embed an attacker-controlled destination within the token structure. When the Approuter processes that token, it inadvertently forwards sensitive credential material (session tokens, JWTs, or OAuth exchange artifacts) to that external destination.

The attack complexity is rated High (AC:H), which reflects the requirement for non-default configuration preconditions. Likely preconditions include environments where:

• Strict destination allow-listing is not enabled on the Approuter, or
• Specific security options related to token destination binding are disabled, or
• Custom header/token forwarding rules are misconfigured.

The attack mechanism is inherently server-side: the attacker does not directly coerce the victim into clicking a link (as in a classic open redirect), but rather crafts a token that the Approuter itself processes and acts upon — resulting in credential leakage (C:H/I:L/A:L). The confidentiality impact is High, indicating that the leaked credential material can likely be used to access backend SAP systems, escalate privileges, or pivot to other internal services.

Code-level specifics (functions, parameter names, endpoint paths) are not disclosed in the NVD description or the CNA title, so the precise vulnerable code path cannot be identified. However, the vulnerability classification (CWE-601) and the described outcome (credential material sent to attacker destination) strongly align with the Approuter's OAuth2 token exchange or JWT validation logic where destination URLs embedded in token claims are used to construct outbound requests.

Exploitation Scenarios

No public PoC or exploit code is available; the following attack chain is inferred from the vulnerability description and class. The attacker has no internal API knowledge beyond what is publicly documented for SAP Approuter configurations.

Step 1 — Reconnaissance / Target Identification: The attacker scans for exposed SAP BTP environments or self-managed Approuter instances. SAP Approuter is a Node.js-based gateway listening on well-known ports (typically 8080 or 5000). Publicly accessible Approuter instances can be identified via default landing pages, Fiori launchpad artifacts, or response headers such as x-sap-approuter or x-vcap-request-id. Shodan queries listed in the METADATA section can surface such targets.

Step 2 — Flaw Trigger: The attacker constructs a crafted JWT or OAuth assertion token that includes a destination claim (e.g., a redirect_uri or a destination URL field) pointing to an attacker-controlled server. Because the Approuter fails to sufficiently validate this token content under the non-default configuration, the token is accepted as authentic. The attacker may deliver this token via a crafted URL that causes the Approuter to process it (e.g., by calling a login or token-exchange endpoint with the malicious token in the Authorization header or a query parameter).

Step 3 — Payload / Execution: The Approuter processes the malicious token and, following the embedded destination value, makes an outbound server-to-server request (e.g., an HTTP redirect or a proxied request) to the attacker-controlled host. Along with this request, the Approuter attaches the sensitive credential material it typically includes in such outbound exchanges — session cookies, access tokens, or backend credentials. The attacker's server logs the incoming HTTP request and harvests the credential material.

Step 4 — Post-Exploitation Impact: With the harvested credentials, the attacker can authenticate as a legitimate user to the SAP backend, access sensitive business data (e.g., financial records, HR data, purchase orders), potentially escalate to administrative functions within the SAP ecosystem, or use the compromised identity to pivot to other enterprise systems integrated with SAP.

Impact Assessment

The vulnerability carries a CVSS score of 7.0 (High) under the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L. The primary risk is the High confidentiality subscore (C:H) — credential exfiltration exposes the most sensitive security material in the SAP ecosystem. Integrity impact (I:L) and availability impact (A:L) are low, suggesting the attacker primarily seeks credential theft rather than data tampering or denial-of-service.

Affected systems are SAP deployments using SAP Approuter, particularly those exposed to the Internet (SAP BTP environments, Fiori gateways, or on-premises deployments with outward-facing Approuter instances). The blast radius extends to all backend services and applications the Approuter proxies — including Fiori apps, S/4HANA systems, SuccessFactors, and any connected cloud or on-prem services. Stolen credentials may grant access to multiple downstream systems, amplifying the business impact beyond the Approuter itself.

Given that no patch exists, this vulnerability is a persistent risk for any enterprise running SAP BTP or Approuter with non-default configurations. The low EPSS score (0.00243) indicates that the vulnerability is currently not being actively targeted in the wild, but the lack of patch availability and the significant confidentiality impact make this a high-priority monitoring item for enterprise security teams.

Detection Guidance

Detection for this vulnerability is challenging in the absence of a known exploit signature. The following rules focus on detecting (a) anomalous outbound requests from Approuter hosts to unknown external destinations, (b) malformed or suspicious token content in HTTP authorization headers, and (c) credential material appearing in HTTP responses from unexpected origins.

Sigma Rule

title: Suspicious Outbound Request from SAP Approuter to Unusual External Destination
id: 8c9e1a2b-3d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects HTTP requests from SAP Approuter hosts to external destinations that may indicate credential exfiltration via crafted token redirect.
author: Valters IT Threat Intelligence
logsource:
  category: proxy
  product: http
  service: any
detection:
  selection:
    method: GET|POST|PUT|DELETE
    hostname: "*-approuter*"  # Adjust to match Approuter host naming convention
  filter_known_dest:
    destination:
      - "*.sap.com"
      - "*.sapcloud.cn"
      - "*.ondemand.com"
  filter_internal:
    destination:
      - "10.*"
      - "192.168.*"
      - "172.16.*"
  condition: selection and not filter_known_dest and not filter_internal
level: medium
falsepositives:
  - Legitimate outbound calls from Approuter to newly-integrated external services
  - Approuter communicating with partner systems during normal operations
fields:
  - destination
  - source_ip
  - user_agent
tags:
  - attack.t1190
  - cve.2026.58230

YARA Rule

rule CVE_2026_58230_SAP_Approuter_Token_Exfil
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects HTTP traffic that may indicate crafted token content targeting SAP Approuter CVE-2026-58230"
        date = "2026-05-15"
        reference = "CVE-2026-58230"
        score = 50

    strings:
        $a = "redirect_uri" nocase
        $b = "destination" nocase
        $c = "authorization" nocase
        $d = "x-approuter" nocase
        $e = "Accept: application/json" nocase
        $f = "eyJ"  // base64 JWT header prefix
        $g = "grant_type=authorization_code" nocase

    condition:
        uint16(0) == 0x0D0A or uint32(0) == 0x0D0A0D0A or
        ($a and $c and ($f or $g)) or
        ($b and $d and $f) or
        articles_condition: ($a or $b) and $d and $f
}

Suricata IDS Rule

alert http any any -> $EXTERNAL_NET any (msg:"CVE-2026-58230 SAP Approuter Potential Credential Exfiltration via Malicious Token"; flow:to_server,established; content:"Authorization"; http_header_names; content:"Bearer"; http_header_names; pcre:"/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\./R"; content:"destination"; http_uri; reference:cve,2026-58230; classtype:attempted-admin; sid:2026582301; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.direction == "egress" and
      destination.domain != null and
      not destination.domain like "*.sap.com" and
      not destination.domain like "*.ondemand.com" and
      network.protocol == "http" and
      process.name == "node" ]
  [ http where http.request.method == "POST" and
      http.response.status_code == 302 and
      url.path like "*oauth*" or url.path like "*login*" ]

Splunk SPL Query

index=proxy sourcetype=httpproxy
| search process_name=node OR sourcetype="approuter" OR host="*approuter*"
| search [search index=proxy sourcetype=httpproxy destination NOT IN ("*.sap.com","*.ondemand.com","*.sapcloud.cn")
    | stats count by destination
    | where count < 10
    | fields destination]
| search method=POST OR method=GET
| search http_status=302
| rex field=url "redirect_uri=(?<redirect_uri>[^\&]+)"
| table _time, src_ip, dest_ip, dest_host, url, redirect_uri, http_user_agent, status
| eval suspicious = if(match(redirect_uri, "(?i)(attacker|evil|pwn|\.xyz|\.top)"), "HIGH", "MEDIUM")
| where suspicious="HIGH"

Wazuh OSSEC Rule

<group name="sap,">
  <rule id="582300" level="12">
    <decoded_as>json</decoded_as>
    <field name="hostname" type="pcre">.*approuter.*</field>
    <field name="dst" type="pcre">[^\.](\.xyz|\.top|\.ru|\.cn)</field>
    <description>SAP Approuter outbound request to suspicious external domain - potential CVE-2026-58230 credential exfiltration.</description>
    <options>no_full_log</options>
    <group>sap_approuter_exfil</group>
  </rule>

  <rule id="582301" level="8">
    <decoded_as>json</decoded_as>
    <field name="authorization" type="pcre">^Bearer\s+eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.</field>
    <field name="url" type="pcre">.*(destination|redirect_uri)=.*</field>
    <description>SAP Approuter token with destination parameter observed in URL. Investigate for CVE-2026-58230 exploitation.</description>
    <options>no_full_log</options>
    <group>sap_approuter_anomaly</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor patch, hotfix, or security note has been identified from any tracked source. The following recommendations are based on the vulnerability's mechanism and SAP best practices:

1) Immediate Mitigations:

• Review and enforce strict destination allow-listing in the SAP Approuter configuration. Ensure that destination values are restricted to a whitelist of approved backend hosts.
• Disable automatic redirect following for token exchange endpoints; ensure the Approuter validates the redirect_uri against a registered set of allowed URIs.
• Inspect Approuter configuration files for any redirect_uri, destination, or token validation settings that may have been set to permissive values.
• Monitor and alert on outbound requests from Approuter hosts to destinations outside the corporate allow-list (use the detection rules above).
• If feasible, restrict network egress from Approuter hosts to only approved destinations via firewall or network security group rules.

2) Patch/Upgrade Steps:

• Subscribe to SAP Security Notes and BTP Security Bulletins. When a patch is released, it will likely be delivered as an update to the @sap/approuter npm package or as a BTP runtime update — apply immediately.
• Establish a rolling upgrade plan for Approuter instances in non-production environments first, followed by production once validated.

3) Long-Term Hardening:

• Implement least-privilege network segmentation: ensure Approuter hosts cannot reach the general Internet; force all outbound traffic through an egress proxy with explicit allow-listing.
• Enable comprehensive audit logging on the Approuter for all token exchange and outbound proxy requests.
• Rotate all credentials and secrets that could be exposed through this vulnerability (client secrets, SAAS tokens, service keys) immediately after confirming no compromise.
• Enforce HTTPS with certificate pinning where possible to reduce the feasibility of man-in-the-middle redirection attacks.
• Review the Approuter configuration against SAP's security hardening guidelines for BTP environments quarterly.

References

1. NVD Entry — CVE-2026-58230: https://nvd.nist.gov/vuln/detail/CVE-2026-58230 (official CVE record with CVSS vector and NVD description)
2. MITRE CWE-601 — URL Redirection to Untrusted Site: https://cwe.mitre.org/data/definitions/601.html (vulnerability class reference)
3. SAP Security Patch Day Advisories (SAP BTP): https://www.sap.com/about/trust-center/security/security-notes.html (monitor for upcoming SAP Security Notes addressing this CVE)
4. SAP Approuter Documentation (BTP): https://help.sap.com/docs/btp/sap-btp-neo-environment/approuter (reference for configuration and security settings related to token validation)
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (verified: CVE-2026-58230 is NOT listed; confirms no known active exploitation)

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: None identified. CISA KEV status is "NO," and EPSS percentile (15.5%) indicates the vulnerability is unlikely to be actively exploited in the near term. No public PoCs, exploit code, or malware kits referencing this CVE have been observed. However, SAP Approuter has historically been a target for credential theft campaigns; enterprises should monitor SAP vendor security advisories closely for updates.