Read the docs
TI-2026-53420 Aliases CVE-2026-76365GHSA-wxjg-wx2p-28mq

Structured Query Language (SQL) Injection through Custom Lists in Splunk SOAR

Priority LOW 31CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database through custom list retrieval in a playbook, allowing for create, read, update, and delete operations on all relevant data stored in the Splunk SOAR database. The SQL injection is possible because Splunk SOAR builds the custom list database lookup with the supplied list name instead of a bound SQL value. For more information see Manage roles and permissions in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) and Create custom lists for use in Splunk SOAR playbook comparisons (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/create-custom-lists-for-use-in-splunk-soar-cloud-playbook-comparisons) in the Splunk documentation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00402 34th percentileScored 2026-11-07
Fix Fixed Splunk SOAR (Splunk): 8.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SplunkSplunk SOAR8.6 to before 8.6.08.6.0Patch availableCNA
  • Splunk SOAR VendorSplunk Affected 8.6 to before 8.6.0 Fixed in 8.6.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:splunk:soar:*:*:*:*:cloud:*:*:*before 8.6.0VulnerableSplunk
cpe:2.3:a:splunk:soar:*:*:*:*:on-premises:*:*:*before 8.6.0VulnerableSplunk
  • cpe:2.3:a:splunk:soar:*:*:*:*:cloud:*:*:* Versions before 8.6.0 Vulnerable ·Splunk
  • cpe:2.3:a:splunk:soar:*:*:*:*:on-premises:*:*:* Versions before 8.6.0 Vulnerable ·Splunk

Remediation

  • Fix · CNA Splunk SOAR (Splunk) Fixed in 8.6.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Splunk SOAR 8.6.0

    15 records Highest priority Priority LOW 15 LOW

    Other records, highest priority first

    • TI-2026-53411 Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOARPriority LOW 38
    • TI-2026-53417 Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOARPriority LOW 34
    • TI-2026-53412 Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOARPriority LOW 34
    Show all 15 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76365
  2. 2026-10-03 Alias added: GHSA-wxjg-wx2p-28mq

References

Advisory 1

  • TI-2026-53411 Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR CVSS 3.1HIGH 8.1
  • TI-2023-03711 Unauthenticated Log Injection In Splunk SOAR CVSS 3.1HIGH 8.6
  • TI-2026-53417 Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAR CVSS 3.1HIGH 7.4
  • TI-2026-53412 Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR CVSS 3.1HIGH 7.6
  • TI-2026-53419 Structured Query Language (SQL) Injection through Custom Function Results in Splunk SOAR CVSS 3.1MEDIUM 6.5
  • TI-2026-53418 Structured Query Language Injection through the REST API in Splunk SOAR CVSS 3.1MEDIUM 6.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences