Executive brief
A security vulnerability exists in the SAP hdi-deploy package, a tool used for deploying database artifacts to SAP HANA. A high-privileged user could potentially manipulate database queries to access unauthorized information or disrupt application availability. While the risk is limited to users who already have significant administrative access, it could lead to data exposure or service instability.
Technical details
A SQL injection vulnerability exists in the @sap/hdi-deploy package due to the dynamic construction of SQL queries using user input without proper parameterization or prepared statements. The vulnerability is classified as CWE-89. An attacker must already possess high privileges (PR:H) and local access (AV:L) to exploit this flaw. Successful exploitation allows the attacker to modify SELECT statements, which can lead to unauthorized data retrieval (confidentiality impact) or service disruption (availability impact), though the integrity of the data remains unaffected. SAP has addressed this in security note 3726962.
Affected products
- SAP @sap/hdi-deploy
Timeline
- 2026-05-12: advisory: SAP published security note 3726962 during the May 2026 Patch Day.
- 2026-05-12: disclosed: CVE-2026-40131 was published to the NVD.