SAP HDI Deploy CVE-2026-40131

Exploitation requires high-privilege account access (PR:H) to the SAP HANA Deployment Infrastructure system with permission to execute deployment operations. The attacker must be able to supply input to the vulnerable SQL construction routine, typically through deployment artifact definitions or configuration files processed by the @sap/hdi-deploy package. Default installations with standard privilege separation models are protected by the high-privilege prerequisite; exploitation is only practical if an administrator account is compromised or if internal policy grants deployment rights to non-administrative users. No special product configuration is required to trigger the vulnerability if privilege restrictions are bypassed.

The CVSS score of 3.4 reflects low immediate risk due to strict privilege requirements (PR:H) and local attack vector (AV:L), placing this in the 'Low' severity category. While SQL injection is a high-consequence vulnerability class (CWE-89), the high-privilege prerequisite significantly constrains the threat model-only administrators or system operators with legitimate database access can exploit this. The impact is limited to confidentiality and availability (no integrity impact per description), though querying sensitive data or causing denial of service remain concerns. The absence of EPSS data, KEV listing, or public exploit code further suggests this is not actively exploited in the wild. For organizations with strong privilege separation and audit logging, this represents manageable risk; however, insider threat scenarios or privilege escalation chains that lead to high-privilege account compromise could enable exploitation.

A malicious database administrator or operator with high-privilege access to an SAP HANA deployment system executes a deployment operation and injects SQL code into a user-controllable input field that is concatenated into a SELECT statement. The injected SQL extracts sensitive data (e.g., system users, configuration tables) or disrupts query performance through resource-intensive subqueries, compromising confidentiality or availability. This scenario requires the attacker to already possess local access and high system privileges.