Description

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database through custom list retrieval in a playbook, allowing for create, read, update, and delete operations on all relevant data stored in the Splunk SOAR database. The SQL injection is possible because Splunk SOAR builds the custom list database lookup with the supplied list name instead of a bound SQL value. For more information see Manage roles and permissions in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) and Create custom lists for use in Splunk SOAR playbook comparisons (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/create-custom-lists-for-use-in-splunk-soar-cloud-playbook-comparisons) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T22:17:21.903Z",
  "pubdate": "2026-08-19T22:17:21.903Z",
  "executiveSummary": "A SQL injection vulnerability exists in Splunk SOAR versions below 8.6.0. The flaw allows authenticated users holding the Automation Engineer role to execute arbitrary Structured Query Language statements directly against the underlying Splunk SOAR database.\nThe vulnerability is triggered during custom list retrieval operations within playbooks, where user-supplied input is improperly concatenated into database queries instead of being handled via parameterized or bound SQL values.\nSuccessful exploitation grants an attacker the capability to perform comprehensive create, read, update, and delete operations across all data stored within the Splunk SOAR database.\nThis introduces severe risks to data confidentiality, integrity, and availability, compromising the entire application state managed by Splunk SOAR.\nExploitation requires specific authentication and the assignment of the Automation Engineer role within the platform, limiting the attack surface to trusted or compromised low-privilege engineering accounts.",
  "technicalDetails": "The root cause of the vulnerability resides in insecure query construction within the custom list retrieval component of Splunk SOAR playbooks. Instead of utilizing prepared statements or bound SQL values to handle database interactions safely, the application concatenates the supplied custom list name directly into the dynamic SQL query string.\nThe vulnerable component is invoked when a playbook attempts to retrieve or reference a custom list. An attacker possessing the 'Automation Engineer' role can supply maliciously crafted input designed to break out of the intended query context and append arbitrary SQL commands.\nThe attack flow proceeds as follows: First, the authenticated attacker creates or modifies a playbook to execute a custom list retrieval operation. Second, the attacker embeds SQL injection payloads into the list name parameter. Third, when the playbook runs, Splunk SOAR dynamically interpolates the untrusted string into the SQL query without adequate sanitization or binding. Fourth, the database execution engine parses and runs the injected SQL commands alongside or instead of the intended query logic.\nBecause the database interactions operate with the privileges of the underlying application service account, the post-exploitation impact is extensive. An attacker can perform arbitrary create, read, update, and delete operations on all relevant data stored within the Splunk SOAR database, potentially exposing sensitive security orchestration data, API keys, credentials, and event details.\nAffected versions comprise all Splunk SOAR deployments below version 8.6.0. The vulnerability requires authentication and specific role assignment (Automation Engineer), meaning unauthenticated external threat actors cannot exploit the flaw directly unless they first compromise an account with the required role permissions."
}