CVE-2026-20260

In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the REST API to view the names and identifiers of tenants outside their role scope. The vulnerability occurs because Splunk SOAR does not enforce role-based tenant restrictions when returning tenant information through the REST API in multi-tenancy deployments.

In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory. The vulnerability is possible because Automation Broker log uploads accept crafted filename input before writing log files.

In Splunk SOAR versions below 8.6.0, a user who holds a role that contains the playbooks:view permission could view metadata about a playbook repository that they are not authorized to view. The vulnerability is possible because Playbook History does not check repository permissions before returning playbook revision metadata.

In Splunk SOAR versions below 8.6.0, a user with the "Incident Commander" role could store JavaScript in a note and run it in another user's browser when that user opens the note. The stored XSS vulnerability is possible because Splunk SOAR can treat existing note content as HTML without sanitizing it when the note format changes.

In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use REST API filtering on playbook runs to recover session tokens that compromise all data available to the affected user. The information disclosure is possible because Splunk SOAR does not block REST API filters from matching values that responses otherwise hide.

In Splunk SOAR versions below 8.6.0, a user with the "Automation Engineer" role could run arbitrary SQL statements against the Splunk SOAR database through custom list retrieval in a playbook, allowing create, read, update, and delete operations on all relevant data. The SQL injection is possible because Splunk SOAR builds the custom list database lookup with the supplied list name instead of a bound SQL value.

In Splunk SOAR versions below 8.6.0, a user with the "Automation Engineer" role could run arbitrary SQL statements against the Splunk SOAR database through custom function results, allowing reading all relevant data and affecting system integrity. The SQL injection is possible because Splunk SOAR builds the database lookup with the supplied name instead of a bound SQL value.

In Splunk SOAR versions below 8.6.0, a user with the "Automation Engineer" role could run arbitrary SQL statements against the Splunk SOAR database and create, read, update, or delete all data in the database. The vulnerability is possible because Splunk SOAR playbook automation data APIs incorporate user-supplied input into database queries without proper neutralization.

In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk REST server could access or modify all relevant data exchanged through that credential manager. The vulnerability exists because the CyberArk REST client does not verify server certificates by default. The attack requires network-path interception capability between Splunk SOAR and the CyberArk REST server.

In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../check_connectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The Server-Side Request Forgery (SSRF) is possible because the connectivity check REST API does not sufficiently validate the destination before Splunk SOAR connects to it.