Description

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system through Nmap Scripting Engine scripts. The vulnerability is possible because the Nmap Scanner connector action manifest classifies the scan network action as read-only even though the action accepts script parameters that can perform write operations. For more information see Manage settings for a playbook in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/manage-settings-for-a-playbook-in-splunk-soar-cloud) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-08-19T22:17:23.050Z",
  "pubdate": "2026-08-19T22:17:23.050Z",
  "executiveSummary": "An improper authorization and input validation vulnerability exists in the Nmap Scanner connector for Splunk SOAR in versions below 3.0.15. The vulnerability arises due to an incorrect action manifest classification where the scan network action is designated as read-only despite accepting script parameters capable of executing write operations. An authenticated attacker holding a role capable of editing, creating, or executing playbooks can leverage Safe Mode playbooks to bypass intended security restrictions. By supplying arbitrary script parameters to the scan network action, an actor can abuse the Nmap Scripting Engine to perform unauthorized command execution and state-altering changes against targeted systems. The business risk includes potential remote code execution, compromise of target assets, and violation of security boundaries within the orchestration platform. Exploitation requires authenticated access with playbook management privileges within Splunk SOAR and interaction with Safe Mode playbooks referencing the vulnerable Nmap Scanner connector.",
  "technicalDetails": "The root cause of this vulnerability is a misclassification within the Nmap Scanner connector action manifest for Splunk SOAR. Specifically, the scan network action is incorrectly defined as a read-only operation. However, the underlying implementation accepts script parameters that permit the invocation of Nmap Scripting Engine scripts capable of performing write operations and system-level interactions. Consequently, authorization enforcement mechanisms fail to restrict state-changing operations when the action is executed.\nThe vulnerable component is the Nmap Scanner connector within Splunk SOAR versions below 3.0.15. The affected functionality involves the processing of playbook parameters within Safe Mode playbooks. Authentication is required, as the attacker must hold a specific role authorized to edit, create, or run playbooks within Splunk SOAR. Privilege requirements include permissions to interact with playbook configuration and execution environments. Network exposure depends on the architecture of the Splunk SOAR deployment and its connectivity to target systems exposed to the Nmap Scanner connector.\nThe step-by-step attack flow proceeds as follows: First, an authenticated user with playbook creation, editing, or execution privileges accesses the Splunk SOAR platform. Second, the actor authors or modifies a Safe Mode playbook that incorporates the Nmap Scanner connector. Third, the actor configures the scan network action within the playbook, leveraging the misclassified read-only status to pass arbitrary Nmap Scripting Engine script parameters that contain write operations or command execution payloads. Fourth, upon execution of the playbook, the Splunk SOAR platform permits the action to run under the assumption that it is a safe, read-only operation. Finally, the Nmap Scanner connector processes the input parameters, executing the Nmap Scripting Engine scripts against the target system, resulting in unauthorized command execution, system modification, or other state changes on the remote target."
}