CVE-2026-103056: AiSOC Command Injection RCE Vulnerability

CVE-2026-103056 Overview

CVE-2026-103056 is a command injection vulnerability [CWE-78] in AiSOC versions 7.2.0 through 12.0.0 (exclusive). The flaw exists in the actions service, which builds CrowdStrike Real Time Response (RTR) command strings by interpolating unescaped parameters in crowdstrike_rtr.py and endpoint.py. Authenticated users can inject single quotes into file_path, path, script_name, or script_args parameters to break out of quoted arguments. Successful exploitation runs arbitrary commands on managed endpoints with SYSTEM or root privileges.

Critical Impact
An authenticated attacker can pivot from the AiSOC actions service into every CrowdStrike-managed endpoint and execute arbitrary commands as SYSTEM or root.

Affected Products

AiSOC 7.2.0 through 11.x (all releases prior to 12.0.0)
AiSOC actions service component (services/actions/app/clients/crowdstrike_rtr.py)
AiSOC endpoint executor (services/actions/app/executors/endpoint.py)

Discovery Timeline

2026-09-30 - CVE-2026-103056 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-103056

Vulnerability Analysis

AiSOC's actions service orchestrates response actions against endpoints managed by CrowdStrike Falcon. To execute commands, it invokes the CrowdStrike Real Time Response API by constructing shell-style command strings on the AiSOC side before shipping them to the RTR channel. The command builder concatenates user-supplied arguments into single-quoted parameters without escaping embedded quote characters. Any authenticated user with permission to trigger endpoint actions can therefore terminate a quoted argument, append arbitrary RTR verbs, and execute commands on any host in scope. Because RTR agents run with SYSTEM on Windows and root on Linux, a successful injection is equivalent to full endpoint compromise across the fleet.

Root Cause

The root cause is string interpolation of untrusted input into quoted RTR command templates in crowdstrike_rtr.py (line 273) and endpoint.py (line 442). Neither routine calls a shell-argument escaper nor validates that inputs remain within their quoted boundaries. Compounding the exposure, the actions service was reachable without a distinct bearer token: AISOC_ACTIONS_SERVICE_TOKEN was undefined by default, and the guard that enforced it exempted itself when AISOC_DEV_MODE was set (its default state).

Attack Vector

An authenticated caller submits an action request whose file_path, path, script_name, or script_args field contains an embedded single quote followed by additional RTR syntax. The actions service serialises the payload into an RTR command, the injected quote closes the intended argument, and the trailing content is executed as a separate command on the target endpoint. See the VulnCheck advisory and the GHSA-7q37-2wfw-xrx7 advisory for parameter details.

python

# Patch excerpt from scripts/ensure_env.py introducing AISOC_ACTIONS_SERVICE_TOKEN
# Distinct from AISOC_SERVICE_TOKEN: the actions service reaches vendor
# APIs and can isolate a host or disable an account, so it does not share
# a credential with the read-mostly services above.
"AISOC_ACTIONS_SERVICE_TOKEN": (
    lambda: secrets.token_urlsafe(32),
    "Shared bearer for the actions service (API -> actions). Gates every response action.",
),

Source: GitHub commit dac3972

Detection Methods for CVE-2026-103056

Indicators of Compromise

Action requests to the AiSOC actions service whose file_path, path, script_name, or script_args fields contain single-quote characters, backticks, or shell metacharacters.
CrowdStrike RTR audit records showing command strings with unexpected verbs appended after a quoted argument.
Deployments running with AISOC_DEV_MODE=true and no configured AISOC_ACTIONS_SERVICE_TOKEN.

Detection Strategies

Review actions service logs for RTR commands that were built from parameters containing ', ;, |, &&, or $(.
Correlate CrowdStrike RTR session logs with the originating AiSOC request identifier to spot commands the operator did not intend to run.
Alert on any RTR runscript, put, or run invocation launched by the actions service outside a documented playbook.

Monitoring Recommendations

Enable verbose audit logging on both the AiSOC actions service and CrowdStrike Falcon RTR, and forward both streams to a central SIEM.
Baseline the volume and command shape of RTR actions per operator and alert on deviations, especially bursts targeting many hosts.
Monitor for creation of new local accounts, scheduled tasks, or persistence artefacts on endpoints shortly after an RTR session initiated by AiSOC.

How to Mitigate CVE-2026-103056

Immediate Actions Required

Upgrade every AiSOC deployment to version 12.0.0 or later using the v12.0.0 release.
Generate and set a strong AISOC_ACTIONS_SERVICE_TOKEN on both the API and actions services so the guard fails closed.
Disable AISOC_DEV_MODE in any environment reachable from production or from untrusted operator accounts.
Rotate CrowdStrike API credentials used by the actions service and audit RTR history for suspicious commands.

Patch Information

The upstream fix is delivered in AiSOC 12.0.0 and consolidated in commit dac3972. The patch refuses RTR arguments that break out of their quotes and requires a dedicated AISOC_ACTIONS_SERVICE_TOKEN bearer that is no longer exempted by development mode. Full remediation details are in GHSA-7q37-2wfw-xrx7.

Workarounds

Restrict network access to the actions service to a small allowlist of trusted callers until the upgrade is applied.
Remove or downscope operator permissions that can invoke file_path, path, script_name, or script_args driven actions.
Scope the CrowdStrike API client used by AiSOC to a limited host group so injection blast radius is bounded.

bash

# Configuration example: generate and require a dedicated actions service token
export AISOC_ACTIONS_SERVICE_TOKEN="$(python -c 'import secrets;print(secrets.token_urlsafe(32))')"
export AISOC_DEV_MODE=false
# Ensure the same value is set on both the api and actions services in docker-compose.yml