Description

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database through custom function results, allowing for reading all relevant data stored in the Splunk SOAR database and affecting system integrity. The SQL injection is possible because Splunk SOAR builds the database lookup with the supplied name instead of a bound SQL value. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T22:17:21.777Z",
  "pubdate": "2026-08-19T22:17:21.777Z",
  "executiveSummary": "A SQL injection vulnerability exists in Splunk SOAR versions below 8.6.0, affecting the custom function results component. The vulnerability arises from improper handling of database lookups, specifically where the application constructs database queries using supplied names directly rather than employing bound SQL values. This flaw allows an authenticated user assigned the Automation Engineer role to execute arbitrary Structured Query Language statements directly against the underlying Splunk SOAR database.\nThe potential impact of successful exploitation includes the complete compromise of system integrity and unauthorized read access to all relevant data stored within the Splunk SOAR database. The risk implications are severe, as unauthorized data exfiltration and database manipulation undermine the confidentiality and integrity of the security orchestration platform. Exploitation requires authenticated access with specific role privileges, specifically holding the Automation Engineer role, and relies on interacting with custom function results to inject malicious SQL payloads.",
  "technicalDetails": "The root cause of the vulnerability is an input sanitization and parameterization failure within Splunk SOAR versions below 8.6.0. Specifically, when the application builds database lookups, it concatenates the supplied name directly into the query string rather than utilizing parameterized queries or bound SQL values. This improper query construction design flaw allows external input to alter the abstract syntax tree of the executed database command.\nThe vulnerable component involves the handling and processing of custom function results within the Splunk SOAR database interaction layer. Exploitation requires authentication and specific privilege requirements, namely holding the Automation Engineer role within the platform. An attacker with this role can supply specially crafted inputs through custom function results that contain malicious SQL statements.\nThe attack flow proceeds as follows: First, the authenticated user with the Automation Engineer role crafts a custom function result containing SQL injection payloads designed to escape the intended query context. Second, the user submits this input to the Splunk SOAR platform. Third, the application receives the input and dynamically incorporates the supplied name directly into the database lookup query string without employing bound SQL values. Fourth, the database engine parses and executes the resulting malicious query alongside the intended application logic. Finally, the payload executes arbitrary database commands, enabling the retrieval of unauthorized data or the modification of database contents, thereby affecting system integrity and achieving comprehensive data access across the backend storage layer."
}