Splunk Soar
Monthly
Improper TLS certificate validation in Splunk SOAR's CyberArk REST client exposes all credential vault traffic to interception and tampering by a network-positioned attacker. Versions below 8.6.0 are affected when a CyberArk REST credential manager integration is configured; the client accepts any server certificate without verification, making TLS sessions transparent to a man-in-the-middle. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog, but the high confidentiality and integrity impact on privileged credential data warrants priority remediation in environments relying on CyberArk for SOAR playbook secrets.
Arbitrary code execution in Splunk SOAR (On-premises) versions below 8.6.0 is reachable by any authenticated user regardless of role assignment, via a crafted file path submitted to the REST API. The REST API endpoint neither enforces role-based access control nor restricts the user-supplied path to the intended temporary directory, enabling path traversal (CWE-22) that culminates in code execution on the SOAR server. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the low privilege barrier - any valid account, zero roles required - meaningfully elevates real-world risk in environments where SOAR accounts are broadly provisioned.
Remote code execution in Splunk SOAR versions below 8.6.0 allows unauthenticated remote attackers to execute arbitrary code on the SOAR host by exploiting the Automation Broker's blind trust of client-supplied IP address headers. The Automation Broker accepts a forged source-IP header as proof that a notification endpoint request originates from the local system (CWE-290), bypassing all authentication. Successful exploitation grants full confidentiality, integrity, and availability impact on the SOAR host; no public exploit is identified at time of analysis, but the vendor has released a patch in version 8.6.0.
Splunk SOAR versions below 8.6.0 expose tenant names and identifiers to authenticated users whose roles restrict them to a subset of tenants, due to a REST API authorization enforcement gap. In multi-tenant deployments, a low-privileged user can enumerate out-of-scope tenant metadata - names and identifiers - without triggering any access control check. No active exploitation or public exploit code has been identified; the CVSS score of 4.3 (Medium) reflects limited confidentiality impact with no integrity or availability consequence.
Path traversal in Splunk SOAR below 8.6.0 enables users holding the OnPrem Broker role to write files to arbitrary locations outside the designated Automation Broker log directory. The flaw stems from the log upload endpoint accepting crafted filenames without adequate sanitization, allowing directory traversal sequences to escape the intended write boundary. No public exploit has been identified and no active exploitation is confirmed; the CVSS score of 2.7 (Low) accurately reflects the high privilege prerequisite and the limited, integrity-only impact.
Splunk SOAR versions below 8.6.0 expose a missing authorization flaw in the Playbook History feature that allows authenticated users holding the `playbooks:view` permission to read metadata about playbook repositories they are not explicitly authorized to access. The Playbook History endpoint omits repository-level permission checks before returning revision metadata, enabling unauthorized information disclosure within role-segregated SOAR deployments. No active exploitation has been confirmed - there is no CISA KEV listing and no public exploit code has been identified - and the CVSS base score of 2.7 reflects the high-privilege prerequisite and narrow confidentiality-only impact scope.
Stored XSS in Splunk SOAR below 8.6.0 enables an authenticated 'Incident Commander' role user to inject JavaScript into a note, which executes in the browser of any user who subsequently opens it. The flaw stems from unsanitized HTML rendering triggered by a note format change, meaning content stored safely in one format becomes executable in another. No public exploit code exists and the vulnerability is absent from CISA KEV; however, successful exploitation could compromise victim session integrity within the SOAR platform.
Session token disclosure in Splunk SOAR versions below 8.6.0 enables any authenticated account holder to recover session tokens belonging to other users by manipulating REST API filters on the playbook run endpoint. Because Splunk SOAR fails to block filter predicates from matching against values that are otherwise suppressed in API responses, an attacker with a low-privilege account can systematically extract credentials granting full access to any targeted user's data within the platform. Splunk has released version 8.6.0 as a fix; no public exploit has been identified at time of analysis, but the low attack complexity elevates urgency for organizations where multiple users share a SOAR instance.
SQL injection in Splunk SOAR below version 8.6.0 enables users holding the "Automation Engineer" role to execute arbitrary SQL statements against the SOAR database by embedding injection payloads in custom list names referenced within playbooks, granting full create, read, update, and delete access to all data the database contains. The root cause is unsanitized string concatenation: Splunk SOAR builds the custom list lookup query by inserting the user-supplied list name directly rather than using parameterized (bound) values, a textbook CWE-74 injection pattern. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV; vendor-released patch version 8.6.0 is available.
SQL injection in Splunk SOAR below version 8.6.0 enables authenticated users holding the "Automation Engineer" role to execute arbitrary SQL statements against the SOAR backend database by supplying crafted values through custom function results. The root cause (CWE-89) is Splunk SOAR concatenating the user-supplied name directly into the database lookup query rather than using parameterized, bound SQL values. Successful exploitation allows full read access to all data stored in the SOAR database - including playbook configurations, incident records, and integration credentials - and can affect database integrity; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
SQL injection in Splunk SOAR's playbook automation data APIs grants any user holding the 'Automation Engineer' role unrestricted read, write, and delete access to the entire SOAR database in versions below 8.6.0. The vulnerability stems from user-supplied input being incorporated into database queries without proper sanitization (CWE-943), enabling arbitrary SQL execution against the SOAR backend. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Splunk has released a patch in version 8.6.0.
Splunk SOAR versions below 8.6.0 contain a Server-Side Request Forgery flaw in the connectivity check REST API endpoint (/rest/support/connectivity/.../check_connectivity) that allows an authenticated Administrator-role user to direct the SOAR platform to initiate outbound network connections to arbitrary destinations. This enables internal network enumeration - discovering reachable hosts and open ports using the SOAR instance's network position, which is typically privileged within enterprise SOC environments. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS score of 2.7 (Low) accurately reflects the high privilege prerequisite, though the risk is elevated in environments where the SOAR platform has broad internal network access.
Unauthorized information disclosure in Splunk SOAR (On-premises) below version 8.6.0 exposes system health and cluster telemetry to any authenticated user, including those with no assigned role, via the /rest/health REST endpoint. The root cause is a missing authorization check (CWE-862) that validates session authentication but omits role-membership verification before returning restricted operational data. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified; vendor patch is available in version 8.6.0 per advisory SVD-2026-0804.
Path traversal in Splunk SOAR's Universal Forwarder credentials-package extraction allows an authenticated Administrator to write files to arbitrary locations on the underlying host filesystem. Affecting all On-premises versions below 8.6.0, the flaw stems from the archive extraction workflow accepting member paths containing directory traversal sequences without first verifying each member's resolved destination. No public exploit or CISA KEV listing exists at time of analysis; however, the Integrity:High and Availability:High CVSS impact ratings indicate that a malicious archive could overwrite system-level files, enabling persistence or privilege escalation beyond SOAR's own permission boundary.
Path traversal during app installation in Splunk SOAR On-premises below version 8.6.0 allows an authenticated user holding app-install privileges to write files outside the intended temporary extraction directory. The archive extraction routine fails to validate that file paths within an uploaded archive remain within the designated staging directory, enabling a classic Zip Slip attack that can overwrite arbitrary files on the host. No public exploit has been identified at time of analysis, and exploitation is constrained by the high-privilege prerequisite (PR:H); a vendor-released patch is available in version 8.6.0.
ANSI escape code injection in Splunk SOAR versions below 8.5.0 allows an unauthenticated remote attacker to embed terminal control sequences into application log files via crafted HTTP request paths. When an administrator subsequently views those logs in a terminal emulator, the escape codes may be interpreted, enabling visual output manipulation such as overwriting displayed text, hiding log entries, or altering terminal state. No public exploit code has been identified at time of analysis, and exploitation requires administrator interaction with affected log output, keeping real-world risk moderate despite the low authentication barrier.
Improper TLS certificate validation in Splunk SOAR's CyberArk REST client exposes all credential vault traffic to interception and tampering by a network-positioned attacker. Versions below 8.6.0 are affected when a CyberArk REST credential manager integration is configured; the client accepts any server certificate without verification, making TLS sessions transparent to a man-in-the-middle. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog, but the high confidentiality and integrity impact on privileged credential data warrants priority remediation in environments relying on CyberArk for SOAR playbook secrets.
Arbitrary code execution in Splunk SOAR (On-premises) versions below 8.6.0 is reachable by any authenticated user regardless of role assignment, via a crafted file path submitted to the REST API. The REST API endpoint neither enforces role-based access control nor restricts the user-supplied path to the intended temporary directory, enabling path traversal (CWE-22) that culminates in code execution on the SOAR server. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the low privilege barrier - any valid account, zero roles required - meaningfully elevates real-world risk in environments where SOAR accounts are broadly provisioned.
Remote code execution in Splunk SOAR versions below 8.6.0 allows unauthenticated remote attackers to execute arbitrary code on the SOAR host by exploiting the Automation Broker's blind trust of client-supplied IP address headers. The Automation Broker accepts a forged source-IP header as proof that a notification endpoint request originates from the local system (CWE-290), bypassing all authentication. Successful exploitation grants full confidentiality, integrity, and availability impact on the SOAR host; no public exploit is identified at time of analysis, but the vendor has released a patch in version 8.6.0.
Splunk SOAR versions below 8.6.0 expose tenant names and identifiers to authenticated users whose roles restrict them to a subset of tenants, due to a REST API authorization enforcement gap. In multi-tenant deployments, a low-privileged user can enumerate out-of-scope tenant metadata - names and identifiers - without triggering any access control check. No active exploitation or public exploit code has been identified; the CVSS score of 4.3 (Medium) reflects limited confidentiality impact with no integrity or availability consequence.
Path traversal in Splunk SOAR below 8.6.0 enables users holding the OnPrem Broker role to write files to arbitrary locations outside the designated Automation Broker log directory. The flaw stems from the log upload endpoint accepting crafted filenames without adequate sanitization, allowing directory traversal sequences to escape the intended write boundary. No public exploit has been identified and no active exploitation is confirmed; the CVSS score of 2.7 (Low) accurately reflects the high privilege prerequisite and the limited, integrity-only impact.
Splunk SOAR versions below 8.6.0 expose a missing authorization flaw in the Playbook History feature that allows authenticated users holding the `playbooks:view` permission to read metadata about playbook repositories they are not explicitly authorized to access. The Playbook History endpoint omits repository-level permission checks before returning revision metadata, enabling unauthorized information disclosure within role-segregated SOAR deployments. No active exploitation has been confirmed - there is no CISA KEV listing and no public exploit code has been identified - and the CVSS base score of 2.7 reflects the high-privilege prerequisite and narrow confidentiality-only impact scope.
Stored XSS in Splunk SOAR below 8.6.0 enables an authenticated 'Incident Commander' role user to inject JavaScript into a note, which executes in the browser of any user who subsequently opens it. The flaw stems from unsanitized HTML rendering triggered by a note format change, meaning content stored safely in one format becomes executable in another. No public exploit code exists and the vulnerability is absent from CISA KEV; however, successful exploitation could compromise victim session integrity within the SOAR platform.
Session token disclosure in Splunk SOAR versions below 8.6.0 enables any authenticated account holder to recover session tokens belonging to other users by manipulating REST API filters on the playbook run endpoint. Because Splunk SOAR fails to block filter predicates from matching against values that are otherwise suppressed in API responses, an attacker with a low-privilege account can systematically extract credentials granting full access to any targeted user's data within the platform. Splunk has released version 8.6.0 as a fix; no public exploit has been identified at time of analysis, but the low attack complexity elevates urgency for organizations where multiple users share a SOAR instance.
SQL injection in Splunk SOAR below version 8.6.0 enables users holding the "Automation Engineer" role to execute arbitrary SQL statements against the SOAR database by embedding injection payloads in custom list names referenced within playbooks, granting full create, read, update, and delete access to all data the database contains. The root cause is unsanitized string concatenation: Splunk SOAR builds the custom list lookup query by inserting the user-supplied list name directly rather than using parameterized (bound) values, a textbook CWE-74 injection pattern. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV; vendor-released patch version 8.6.0 is available.
SQL injection in Splunk SOAR below version 8.6.0 enables authenticated users holding the "Automation Engineer" role to execute arbitrary SQL statements against the SOAR backend database by supplying crafted values through custom function results. The root cause (CWE-89) is Splunk SOAR concatenating the user-supplied name directly into the database lookup query rather than using parameterized, bound SQL values. Successful exploitation allows full read access to all data stored in the SOAR database - including playbook configurations, incident records, and integration credentials - and can affect database integrity; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
SQL injection in Splunk SOAR's playbook automation data APIs grants any user holding the 'Automation Engineer' role unrestricted read, write, and delete access to the entire SOAR database in versions below 8.6.0. The vulnerability stems from user-supplied input being incorporated into database queries without proper sanitization (CWE-943), enabling arbitrary SQL execution against the SOAR backend. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Splunk has released a patch in version 8.6.0.
Splunk SOAR versions below 8.6.0 contain a Server-Side Request Forgery flaw in the connectivity check REST API endpoint (/rest/support/connectivity/.../check_connectivity) that allows an authenticated Administrator-role user to direct the SOAR platform to initiate outbound network connections to arbitrary destinations. This enables internal network enumeration - discovering reachable hosts and open ports using the SOAR instance's network position, which is typically privileged within enterprise SOC environments. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS score of 2.7 (Low) accurately reflects the high privilege prerequisite, though the risk is elevated in environments where the SOAR platform has broad internal network access.
Unauthorized information disclosure in Splunk SOAR (On-premises) below version 8.6.0 exposes system health and cluster telemetry to any authenticated user, including those with no assigned role, via the /rest/health REST endpoint. The root cause is a missing authorization check (CWE-862) that validates session authentication but omits role-membership verification before returning restricted operational data. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified; vendor patch is available in version 8.6.0 per advisory SVD-2026-0804.
Path traversal in Splunk SOAR's Universal Forwarder credentials-package extraction allows an authenticated Administrator to write files to arbitrary locations on the underlying host filesystem. Affecting all On-premises versions below 8.6.0, the flaw stems from the archive extraction workflow accepting member paths containing directory traversal sequences without first verifying each member's resolved destination. No public exploit or CISA KEV listing exists at time of analysis; however, the Integrity:High and Availability:High CVSS impact ratings indicate that a malicious archive could overwrite system-level files, enabling persistence or privilege escalation beyond SOAR's own permission boundary.
Path traversal during app installation in Splunk SOAR On-premises below version 8.6.0 allows an authenticated user holding app-install privileges to write files outside the intended temporary extraction directory. The archive extraction routine fails to validate that file paths within an uploaded archive remain within the designated staging directory, enabling a classic Zip Slip attack that can overwrite arbitrary files on the host. No public exploit has been identified at time of analysis, and exploitation is constrained by the high-privilege prerequisite (PR:H); a vendor-released patch is available in version 8.6.0.
ANSI escape code injection in Splunk SOAR versions below 8.5.0 allows an unauthenticated remote attacker to embed terminal control sequences into application log files via crafted HTTP request paths. When an administrator subsequently views those logs in a terminal emulator, the escape codes may be interpreted, enabling visual output manipulation such as overwriting displayed text, hiding log entries, or altering terminal state. No public exploit code has been identified at time of analysis, and exploitation requires administrator interaction with affected log output, keeping real-world risk moderate despite the low authentication barrier.