CVE-2026-76365: Splunk SOAR SQL Injection Vulnerability

CVE-2026-76365 Overview

CVE-2026-76365 is a Structured Query Language (SQL) injection vulnerability in Splunk SOAR versions below 8.6.0. An authenticated user assigned the Automation Engineer role can execute arbitrary SQL statements against the Splunk SOAR database. The flaw resides in the custom list retrieval logic inside playbooks, where the supplied list name is concatenated into a database query instead of being passed as a bound parameter. Successful exploitation permits create, read, update, and delete operations across data stored in the Splunk SOAR database. The issue is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
An authenticated Automation Engineer can read, modify, or delete any records in the Splunk SOAR database through playbook custom list lookups.

Affected Products

Splunk SOAR versions below 8.6.0
Splunk SOAR on-premises deployments running vulnerable releases
Splunk SOAR Cloud instances not yet updated to fixed builds

Discovery Timeline

2026-08-19 - CVE-2026-76365 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76365

Vulnerability Analysis

Splunk SOAR playbooks can retrieve entries from custom lists during automation execution. The database lookup that resolves a custom list by name builds its SQL statement through string composition using the user-supplied list name. Because the value is not bound as a parameter, an attacker with the Automation Engineer role can embed additional SQL syntax inside the list name argument. The injected statement executes with the privileges of the Splunk SOAR database user, which has broad access to application data.

The impact extends across the entire Splunk SOAR database. Attackers can exfiltrate playbook secrets, alter automation logic, remove audit records, or corrupt case data. Because the vulnerable code path runs inside trusted playbook execution, injected queries bypass API-layer authorization controls that normally restrict data access.

Root Cause

The root cause is unsafe query construction in the custom list retrieval routine. The list name argument is interpolated directly into the SQL text rather than passed through a parameterized statement or object-relational mapping binding. This design allows any character permitted in a list name — including quotes, semicolons, and comment sequences — to alter the query structure.

Attack Vector

Exploitation requires network access to the Splunk SOAR web interface or API and valid credentials for an account holding the Automation Engineer role. The attacker authors or modifies a playbook that performs a custom list lookup and supplies a crafted list name containing SQL payload characters. When the playbook runs, the injected SQL executes against the backend database. No user interaction beyond playbook execution is needed.

No verified proof-of-concept exploit is publicly available. Refer to the Splunk Security Advisory SVD-2026-0804 for vendor-provided technical detail.

Detection Methods for CVE-2026-76365

Indicators of Compromise

Custom list names in playbook definitions or audit logs containing SQL metacharacters such as single quotes, semicolons, --, or UNION SELECT fragments
Unexpected modifications, deletions, or insertions in Splunk SOAR database tables that do not correspond to legitimate user actions
Playbook executions initiated by Automation Engineer accounts that immediately precede anomalous database write patterns

Detection Strategies

Review playbook code and revision history for custom list retrieval calls where the list name argument contains untrusted or dynamic input
Enable and inspect Splunk SOAR audit logs for playbook edits, executions, and role assignments performed by Automation Engineer users
Correlate database-layer query logs, if available, with playbook execution timestamps to identify malformed or unexpectedly complex SQL statements

Monitoring Recommendations

Monitor role membership changes for the Automation Engineer role and alert on new assignments
Track playbook creation and modification events, particularly those touching custom list operations
Baseline normal query volume from the Splunk SOAR application account and alert on deviations that could indicate mass data extraction

How to Mitigate CVE-2026-76365

Immediate Actions Required

Upgrade Splunk SOAR to version 8.6.0 or later as documented in Splunk Security Advisory SVD-2026-0804
Audit accounts assigned the Automation Engineer role and remove assignments that are not operationally required
Review recently modified or newly created playbooks for suspicious custom list retrieval logic

Patch Information

Splunk has addressed the SQL injection in Splunk SOAR 8.6.0. The fix binds the custom list name as a parameterized SQL value rather than concatenating it into the query. Administrators should consult the Splunk Security Advisory SVD-2026-0804 for supported upgrade paths and Splunk SOAR Cloud remediation status.

Workarounds

Restrict the Automation Engineer role to trusted operators until the upgrade completes, following the guidance in the Splunk documentation for managing roles and permissions in Splunk SOAR
Require code review for all playbook changes that call custom list retrieval functions
Isolate the Splunk SOAR management interface to trusted administrative networks to reduce the attack surface for credentialed access

bash

# Verify the installed Splunk SOAR version before and after patching
# Replace <soar-host> with your Splunk SOAR instance
curl -sk -u <admin-user> https://<soar-host>/rest/version | jq .

# Expected: version field reports 8.6.0 or later