SQL Injection Vulnerability in Splunk SOAR by Splunk

CVE-2026-76364

What is CVE-2026-76364?

In versions of Splunk SOAR prior to 8.6.0, a vulnerability exists that allows users with the 'Automation Engineer' role to execute arbitrary SQL statements against the Splunk SOAR database. This occurs via the custom function results, which permits unauthorized data retrieval and compromises the integrity of the system. The issue arises because the SQL queries construct the database lookup using unsanitized inputs instead of binding SQL parameters properly. As a result, attackers could exploit this flaw to gain access to sensitive information stored within the Splunk SOAR database, posing a significant risk to overall data security and system functionality.

References