SQL Injection Flaw in Splunk SOAR by Splunk

CVE-2026-76363

What is CVE-2026-76363?

In Splunk SOAR prior to version 8.6.0, an SQL injection vulnerability exists that allows users with the 'Automation Engineer' role to execute arbitrary SQL commands against the Splunk SOAR database. This flaw arises because user-supplied input in playbook automation data APIs is not adequately sanitized before being incorporated into database queries. This oversight can lead to unauthorized data manipulation, including the ability to create, read, update, or delete any data within the database. For detailed management of roles and permissions in Splunk SOAR, refer to the official documentation.

References