CVE-2026-27690 HTTP Request Smuggling in SAP Approuter
An unauthenticated attacker can exploit HTTP request smuggling in SAP Approuter to expose user data and cause system unavailability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27690?
CVE-2026-27690 is a critical vulnerability in SAP_SE SAP Approuter, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.
Weakness: CWE-444
Which versions are affected by CVE-2026-27690?
2 open source packages ship an affected version, including @sap/approuter. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@sap/approuter npm | All versions | 20.10.0 |
@sap/approuter npm | All versions | 20.10.0 |
Products include Sap Approuter.
How do I fix CVE-2026-27690?
Upgrade @sap/approuter to 20.10.0 or later.
Is CVE-2026-27690 being exploited?
There is no known exploitation of CVE-2026-27690 in the wild and no public exploit code.
Other vulnerabilities in SAP_SE SAP Approuter
- CVE-2026-44745 Open Redirect vulnerability in SAP Approuter
- CVE-2026-58230 Multiple vulnerabilities in SAP Business AI Platform (Approuter)
- CVE-2026-66760 Multiple vulnerabilities in SAP Business AI Platform (Approuter)
- CVE-2026-58237 Multiple vulnerabilities in SAP Business AI Platform (Approuter)
- CVE-2026-58238 Multiple vulnerabilities in SAP Business AI Platform (Approuter)
Sources
Also known as GHSA-8m85-wqg7-c529.