Description

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Transfer (REST) API and execute arbitrary code. The vulnerability is possible because the REST API does not require an assigned role for the request and does not restrict the user-supplied file path to the intended temporary directory. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Splunk SOAR (On-premises) security information (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/introduction-to-splunk-soar-on-premises/splunk-soar-on-premises-security-information) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-19T22:17:20.873Z",
  "pubdate": "2026-08-19T22:17:20.873Z",
  "executiveSummary": "An arbitrary code execution vulnerability exists in Splunk SOAR versions below 8.6.0. The vulnerability stems from insufficient access control enforcement and inadequate input validation within the Representational State Transfer (REST) API. Specifically, the API endpoint fails to enforce mandatory role assignments for incoming requests and lacks proper path restriction controls over user-supplied file paths, allowing them to traverse outside the intended temporary directory.\nAn authenticated attacker with no assigned role can leverage this flaw to submit a crafted file path via the REST API, resulting in arbitrary code execution on the underlying host. The risk implications are severe, as successful exploitation could lead to complete compromise of the affected Splunk SOAR (On-premises) system. Exploitation requires valid authentication, specifically an authenticated user account lacking any assigned role, and the ability to interact with the vulnerable REST API endpoints.",
  "technicalDetails": "The root cause of this vulnerability lies in a combination of broken access control and path traversal within the Splunk SOAR Representational State Transfer (REST) API. Specifically, the affected REST API routes fail to properly validate or enforce role-based access control, allowing requests from authenticated users who possess no assigned role. Furthermore, the component responsible for processing file paths supplied within API requests fails to restrict the input to the designated temporary directory.\nThe attack flow proceeds as follows. First, an authenticated attacker authenticates to the Splunk SOAR (On-premises) platform using an account with no assigned role. Second, the attacker interacts with the vulnerable Representational State Transfer (REST) API by transmitting a crafted HTTP request containing a maliciously manipulated file path parameter. Because the application logic fails to sanitize or constrain the user-supplied file path to the intended temporary directory, the input facilitates arbitrary file manipulation or traversal. Finally, by leveraging this unrestricted file path handling, the attacker is able to write, access, or execute arbitrary code within the context of the application server.\nThe vulnerable component is the Representational State Transfer (REST) API subsystem of Splunk SOAR (On-premises). The affected versions comprise all Splunk SOAR installations below version 8.6.0. The vulnerability requires authentication, but notably requires zero privileges, as it can be exploited by an authenticated user with no role assigned. The network exposure encompasses the administrative or API access vectors of the Splunk SOAR deployment. Post-exploitation impact includes arbitrary code execution on the host running Splunk SOAR, potentially leading to full system compromise, unauthorized data access, and further pivoting within the internal network."
}