Executive brief
Splunk SOAR's Automation Broker component incorrectly trusts client-supplied IP address headers to verify request origin. An unauthenticated attacker can spoof their source IP address to bypass authentication controls and execute arbitrary code on the SOAR host, compromising all data, system integrity, and service availability.
Technical details
The vulnerability is an authentication bypass (CWE-290) in the Automation Broker notification endpoint of Splunk SOAR versions below 8.6.0. The root cause is that the Automation Broker trusts client-supplied source IP address headers as proof of local system origin, allowing an attacker to forge requests. No authentication or role assignment is required; an unauthenticated user can craft a request with a spoofed IP header to the notification endpoint and achieve arbitrary code execution (RCE) on the SOAR host. The attack is network-accessible with high complexity (CVSS AV:N/AC:H). Splunk addressed this vulnerability by releasing SOAR 8.6.0 and later.
Affected products
- Splunk SOAR below 8.6.0
Timeline
- 2026-08-19: disclosed