CVE-2026-76369: Path Traversal through Automation Broker in Splunk SOAR
In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory. The vulnerability is possible because Automation Broker log uploads accept crafted filename input before writing log files. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) and About Splunk SOAR Automation Broker (https://help.splunk.com/en/splunk-soar/splunk-automation-broker/about-splunk-soar-automation-broker/about-splunk-soar-automation-broker) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk SOARto a version that resolves this vulnerability.Fixed in 8.6.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated user with the OnPrem Broker role. The affected functionality is Automation Broker log upload handling.
Which deployments are affected?
Splunk SOAR versions below 8.6.0 are affected. The issue applies where Automation Broker log uploads are available to a user holding the OnPrem Broker role.
What does an attacker need to do?
The attacker must provide a crafted filename as part of an Automation Broker log upload. The crafted filename can cause files to be written outside the intended Automation Broker log directory.
What should be done if upgrading is not immediately possible?
Restrict assignment of the OnPrem Broker role to only trusted users, since that role is required for exploitation. Review Automation Broker log-upload activity and file locations for unexpected files outside the intended log directory.