SAP HANA Trace/Backup File & Credential Exposure

Updated on Sep 18, 2026

Description

HANA writes diagnostic detail to per-service trace files (nameserver, indexserver, compileserver, Web Dispatcher) and, at higher trace levels, this detail has repeatedly included credentials and connection secrets in plaintext or lightly-obfuscated form. Separately, HANA’s default tenant isolation level is low: the single OS user <sid>adm that runs the database has filesystem access to every tenant’s backups, redo logs, trace files, and persisted data - there is no OS-level separation between tenants unless the administrator explicitly raises isolation to high. Once OS-level or <sid>adm-equivalent access is obtained (via RFC command execution, a compromised backup pipeline, or direct host access), these two facts combine into a broad credential- and data-exfiltration surface that requires no additional HANA authentication.

Risk

CVE-2019-0266 - Potential Information Disclosure in SAP HANA XS advanced (CWE-532). CVSS 3.0 6.8 (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H). Confirmed via SAP Note 2724713: XSA CLI commands that accept credentials as command-line parameters (for batch/scripted admin tasks) have those arguments written to the nameserver trace file, which - while restricted to <sid>adm - increases the blast radius once that OS boundary is crossed. Fixed in XS advanced runtime ≥1.0.98 plus HANA revisions 122.22 (1.00 SPS12) / 24.08 (2.0 SPS02) / 36.00 (2.0 SPS03).
CVE-2018-2402 - Potential information disclosure in SAP HANA capture & replay trace file (CWE-200). NIST CVSS 3.0 8.4 (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H). Confirmed via SAP Note 2587369: when the optional capture & replay feature is used and workloadreplaycmd/workloadreplayerservice trace level is info or higher, replay-admin-entered credentials for captured users are written in clear text to the indexserver trace file of the control system. Requires only TRACE_ADMIN or CATALOG READ to read. Fixed at HANA 1 SP12 rev 122.15 / 2 SP01 rev 12.03 / 2 SP02 rev 23.
CVE-2016-3640 / CVE-2015-7991 - Web Dispatcher trace file password disclosure (CWE-200). Confirmed via SAP Note 2148905 (CVSS 1.5) and SAP Note 2148854 (CVSS 5.0): at elevated trace levels, both the standalone and internal HANA Web Dispatcher log request bodies - including XS-application passwords - to trace files; the standalone/ICM variant was additionally remotely readable via the (optional) Web Dispatcher Administration UI. 
CVE-2026-34262 - Information Disclosure in SAP HANA Cockpit and HANA Database Explorer (see Known CVEs for full detail) - a Cockpit/Database Explorer user can retrieve the server’s mTLS private key via the hrtt-service REST API, a distinct but related credential/cert-exposure vector reachable through the same admin tooling that surfaces trace files.

Options

Locate and read trace files directly via OS/RFC access (any of: SXPG_STEP_XPG_START/SM49 OS command execution on a connected AS ABAP, direct <sid>adm shell, or SAP HANA cockpit’s Database Explorer trace viewer):
```
find /usr/sap/<SID>/HDB<NN>/<host>/trace -iname '*nameserver*' -newer /tmp/marker
grep -iE 'password|passwd|pwd=' /usr/sap/<SID>/HDB<NN>/<host>/trace/*.trc
```
Prioritize nameserver_*.trc (XSA CLI credential leakage, CVE-2019-0266), indexserver_*.trc (capture & replay, CVE-2018-2402), and any wdisp_*/ICM trace files if the Web Dispatcher trace level was ever raised above default.
Backup and redo-log exfiltration - under the default low tenant-isolation level, any process running as <sid>adm (i.e., anything achieving OS command execution on the HANA host) can read every tenant’s data:
```
ls -la /usr/sap/<SID>/HDB<NN>/backup/data/
ls -la /usr/sap/<SID>/HDB<NN>/backup/log/
```
Backups are not HANA-credential-protected at the filesystem layer - possession of the files plus the DB’s data-volume encryption key (or an unencrypted backup) is sufficient for offline restore/inspection.
hdbuserstore credential harvesting - see Default Users, Credential Harvesting & Privilege Escalation for the hdbuserstore LIST / hdbsql -U DEFAULT workflow and Decrypting SAP Secure Storage for offline SSFS decryption.
HANA Cockpit / Database Explorer mTLS key exposure (CVE-2026-34262) - an authenticated Cockpit or Database Explorer user (Cockpit Administrator or User role) queries the HRTT service:
```
GET /hrtt-service/sap/hana/cst/api/v2/databases
```
and, after normal Database Explorer interaction, the JSON response includes the connected database’s certificate chain and mTLS private key in plaintext. Affects SAP HANA Runtime Tools (HRTT) ≤ 2.16.254001 / HANA Cockpit < 2.18.2.

Mitigation

Keep trace levels at their default/error defaults; only raise to info/debug for the minimum time needed and delete resulting trace files immediately after troubleshooting (SAP Note 2148905, SAP Note 2724713).
Never pass credentials as XSA CLI command-line parameters - provide them interactively (SAP Note 2724713).
For capture & replay, use the SAP HANA cockpit password-reset feature (≥2.4.11) before replay to avoid writing real captured-user passwords to trace, and set workloadreplaycmd/workloadreplayerservice trace level to error (SAP Note 2587369).
Raise tenant isolation to high where multi-tenancy is used, so tenant administrators - not a single shared <sid>adm - own each tenant’s backups/logs/data files.
Patch HANA Cockpit to ≥2.18.2 / HRTT to ≥2.16.254002 (SAP Note 3730639); per SEC Consult, manually rotate any mTLS certificates/private keys used before the patch - the fix prevents further exposure but does not invalidate already-disclosed keys.
Restrict filesystem permissions on /usr/sap/<SID>/HDB<NN>/{trace,backup} to <sid>adm; restrict TRACE_ADMIN/CATALOG READ grants.

Detection and Monitoring

File-access auditing on /usr/sap/<SID>/HDB<NN>/{trace,backup} for reads by any account other than <sid>adm or the backup service account.
SYS.M_TRACEFILES / SAP HANA cockpit trace-file listing - review for unexpected trace-level escalations (correlate with INIFILEADMIN/sap.hana.xs.wdisp.admin::WebDispatcherAdmin grant usage).
Requests to /hrtt-service/sap/hana/cst/api/v2/databases from non-administrative Cockpit sessions - not normal end-user Database Explorer traffic.
SYS.M_BACKUP_CATALOG access combined with unexpected OS-level reads of the backup directory outside the scheduled backup job’s service account.