Description

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database and create, read, update, or delete all data in the database. The vulnerability is possible because Splunk SOAR playbook automation data APIs incorporate user-supplied input into database queries without proper neutralization. For more information see Manage roles and permissions in Splunk SOAR Cloud (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T22:17:21.653Z",
  "pubdate": "2026-08-19T22:17:21.653Z",
  "executiveSummary": "Splunk SOAR versions below 8.6.0 contain a critical database query neutralization flaw that enables unauthorized data manipulation and arbitrary database query execution. Specifically, the vulnerability allows a malicious actor holding the Automation Engineer role to execute arbitrary Structured Query Language (SQL) statements directly against the underlying Splunk SOAR database.\nThe primary impact of this security flaw includes a complete compromise of confidentiality, integrity, and availability of all data stored within the affected database. Attackers possessing the required role-based privileges can perform unrestricted create, read, update, and delete (CRUD) operations on sensitive system and operational data.\nThe affected product is Splunk SOAR in versions prior to 8.6.0. The risk implications are severe, as internal threat actors or compromised accounts assigned the Automation Engineer role can leverage this capability to pivot further, exfiltrate sensitive security automation data, or manipulate database contents.\nExploitation of this vulnerability requires authentication and an existing user account assigned with the Automation Engineer role. Attackers leverage user-supplied input paths exposed through the product's playbook automation data APIs, which fail to properly sanitize or neutralize parameters before incorporating them into database queries.",
  "technicalDetails": "The root cause of this vulnerability lies in improper neutralization of user-supplied input within Splunk SOAR playbook automation data APIs. The application dynamically incorporates input parameters directly into database queries without adequate parameterization, input sanitization, or context-aware escaping, thereby introducing a classic SQL injection vulnerability.\nThe vulnerable component comprises the playbook automation data application programming interfaces and their underlying database interaction layers. Affected versions include all deployments of Splunk SOAR below version 8.6.0.\nRegarding authentication and privilege requirements, the attack surface is accessible to authenticated users who possess the Automation Engineer role. While network exposure depends on the specific deployment architecture of the Splunk SOAR instance, the attack vector is exposed through the application's standard API interfaces used for playbook automation.\nThe step-by-step attack flow proceeds as follows: First, an authenticated attacker obtains or utilizes an account provisioned with the Automation Engineer role. Second, the attacker crafts malicious payloads containing arbitrary Structured Query Language statements designed to bypass input expectations within the playbook automation data APIs. Third, the application accepts the user-supplied input and improperly interpolates it directly into the backend database query strings. Fourth, the database execution engine parses and processes the injected SQL commands alongside or in place of the intended query logic.\nThe payload behavior allows the execution of arbitrary database commands, enabling the attacker to interact directly with backend database tables. The post-exploitation impact is catastrophic, granting the actor full ability to create, read, update, or delete all records stored in the Splunk SOAR database, leading to potential data theft, data destruction, and unauthorized modification of system state."
}