Executive brief
Splunk SOAR is a security orchestration platform used to automate incident response workflows. A user with the "Automation Engineer" role can inject SQL commands through the playbook automation REST API, allowing them to read, modify, or delete any data stored in the SOAR database. This undermines data security and could expose sensitive incident response records and customer information.
Technical details
The vulnerability is a SQL injection (CWE-943) in the Splunk SOAR playbook automation REST API. The API fails to neutralize user-supplied input before incorporating it into database queries. An authenticated user holding the "Automation Engineer" role can craft malicious SQL statements to execute arbitrary queries against the Splunk SOAR database. Successful exploitation allows complete unauthorized access to create, read, update, or delete data. The fix is available in version 8.6.0 and higher.
Affected products
- Splunk SOAR below 8.6.0
Timeline
- 2026-08-19: disclosed
- 2026-08-19: patched: Fix available in version 8.6.0