CVE-2026-20260: Log Injection through HTTP Request Paths in Splunk SOAR
In Splunk SOAR (Security Orchestration, Automation, and Response) versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute (ANSI) escape codes into SOAR application log files through specially crafted HTTP request paths, which a terminal emulator might interpret when an administrator views the logs.<br><br>The injection is possible because SOAR does not strip control characters from HTTP request paths before writing them to application logs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk SOARto a version that resolves this vulnerability.Fixed in 8.5.0 - Configuration
Configure SOAR to strip or sanitize control characters (including ANSI escape codes) from HTTP request paths before writing them to application logs.
Splunk SOAR strip_control_characters_from_http_request_paths = true - Compensating control
When viewing application logs, use a log viewer or terminal emulator that does not interpret ANSI escape sequences or disable ANSI interpretation in the terminal; restrict access to log viewing to trusted administrators until the product is upgraded or sanitization is implemented.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20260?
CVE-2026-20260 has a medium severity rating of 4.3.
How do I fix CVE-2026-20260?
To mitigate CVE-2026-20260, upgrade Splunk SOAR to version 8.5.0 or later.
What type of attack is described in CVE-2026-20260?
CVE-2026-20260 describes a log injection vulnerability through HTTP request paths.
Which versions of Splunk SOAR are affected by CVE-2026-20260?
CVE-2026-20260 affects all Splunk SOAR versions below 8.5.0.
Can an attacker exploit CVE-2026-20260 without authentication?
Yes, an unauthenticated attacker can exploit CVE-2026-20260.