CVE-2026-76364: Structured Query Language (SQL) Injection through Custom Function Results in Splunk SOAR
In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database through custom function results, allowing for reading all relevant data stored in the Splunk SOAR database and affecting system integrity. The SQL injection is possible because Splunk SOAR builds the database lookup with the supplied name instead of a bound SQL value. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.6.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires a Splunk SOAR user with the Automation Engineer role. The vulnerability is therefore not exploitable by an unauthenticated user based on the available information.
Which deployments are affected?
Splunk SOAR versions below 8.6.0 are affected. The issue occurs in database lookups involving custom function results.
What access could successful exploitation provide?
An attacker can execute arbitrary SQL statements against the Splunk SOAR database. This can expose relevant data stored in the database and affect system integrity.
What should be prioritized for mitigation?
Upgrade affected Splunk SOAR deployments to version 8.6.0 or later. Until then, review and restrict assignment of the Automation Engineer role because that role is required for exploitation.